fix(guard): CRAFT_GUARD_ALLOW_DEV_EDIT escape hatch for /craft:git:unprotect deadlock

[Data-Wise]

Summary

Closes #281. /craft:git:unprotect collects human consent via AskUserQuestion, then writes .claude/allow-dev-edit — but creating that marker is itself intercepted by branch-guard's own confirm gate (edit_guard_bypass / write_guard_bypass / bash_guard_bypass, 3 call sites). In a non-interactive/auto-mode session there is no way for the already-given consent to resolve the resulting exit-2 block: hooks are stateless per-invocation, and AskUserQuestion's answer isn't visible to the next hook call.

Adversarial review of the issue's own recommended path: the issue proposes empirically verifying whether permissionDecision: "ask" denies safely in a genuinely headless session — flagged as a factual unknown requiring verification before implementation. That verification isn't something I can do reliably from this environment, so rather than guess at undocumented hook-protocol behavior, I recognized the deadlock is structurally identical to issue #168 (git branch -D force-delete, already fixed this session) and reused that exact escape-hatch shape instead.

A "nonce-bound consent file" approach was already adversarially reviewed and rejected in the issue's own investigation: the consent file would just be an ordinary file Claude can write itself, with no AskUserQuestion ever having fired — strictly worse than the status quo. CRAFT_GUARD_ALLOW_DEV_EDIT avoids that flaw the same way CRAFT_GUARD_ALLOW_FORCE_DELETE does: it's an env var the user pre-authorizes out-of-band (shell profile / Claude env), which the agent's own Bash tool calls cannot inject into the hook's separate process invocation — not self-authorizable.

Scope: narrowly limited to the 3 allow-once/allow-dev-edit marker-write call sites. Does not touch block-all (main), the catastrophic-ops hard blocks, or ~/.claude/settings.json hard_deny — all confirmed out of scope per the issue's own constraints.

Test plan

• Reproduced the original deadlock before/after (scratch repo), per the issue's own test requirement
• 7 new tests in test_branch_guard.sh: baseline still confirms without the env var (regression guard), new allow-with-env behavior across all 3 call sites (Edit/Write/Bash-touch), and the env var does NOT globalize to unrelated MEDIUM-risk gates
• tests/test_branch_guard.sh against both the repo copy and the installed hook: 141/141 passed
• Full suite: python3 -m pytest tests/ — 2615 passed / 0 failed / 49 skipped / 1 xfailed / 1 xpassed
• Documented in skills/dev/git/SKILL.md Operation 10 so a future session hitting this deadlock finds the fix instead of looping

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com