Deny gate host configuration reads

[chasebryan]

Summary

• remove broad copied-command read grants for /etc and /sys
• assert that host account configuration and sysfs CPU state remain unreadable
• disable system Git configuration and bind global Git configuration to /dev/null for every copied command
• centralize the same hermetic Git baseline across all foundation test fixtures
• suppress the gate probe own Bash startup-file lookup with --norc
• document the narrower boundary and advance repository policy to 0.2.94

Verification

• scripts/ci/check-repository
• 288 standalone foundation validator tests
• python3 tools/validate_foundation.py
• git diff --check

The complete repository gate passed on exact head 72f2c4d, including debug and release Rust suites, relocated reproducibility builds, and doc tests. Earlier PR heads exposed hosted Git 2.54 reading /etc/gitconfig from fixture environments; this head fixes those environments directly without reopening /etc.