fix(loop): allow exact restore Git probes

[codeacme17]

Summary

• allow the trusted automation descendant gate to run only the two exact read-only Git probes used by restore-checkpoint
• keep all broader ls-files and git -c shapes denied
• add allow/deny routing regressions

Verification

• pnpm exec eslint loops/issue-dev-loop/scripts/lib/github-identity.mjs loops/issue-dev-loop/tests/github-identity-routing.test.mjs
• node --test loops/issue-dev-loop/tests/github-identity-routing.test.mjs (47/47)
• pnpm loop:issue-dev:test (105/105)
• loop validation: 67 files

Context

This is an owner-reviewed control-plane bootstrap fix discovered while resuming #108. The merged restore cleanliness check invokes these probes through the authenticated descendant Git gate; without the exact allowlist entries, restore-checkpoint is blocked before restoring the durable checkpoint.

This PR must remain Draft. Only codeacme17 may mark it Ready, approve, or merge it.