When an attacker can convince a user to clone a crafted repository that
contains an embedded bare repository with malicious hooks, any Git
command the user runs after entering that subdirectory will discover the
bare repository and execute the hooks. The user does not even need to run
a Git command explicitly: many shell prompts run `git status` in the
background to display branch and dirty state information, and `git
status` in turn may invoke the fsmonitor hook if so configured, making
the user vulnerable the moment they `cd` into the directory. The
safe.bareRepository configuration variable (introduced in 8959555
(setup_git_directory(): add an owner check for the top-level directory,
2022-03-02)) already provides protection against this attack vector by
allowing users to set it to "explicit", but the default remained "all"
for backwards compatibility.

Since Git 3.0 is the natural point to change defaults to safer values,
flip the default from "all" to "explicit" when built with
WITH_BREAKING_CHANGES. This means Git will refuse to work with bare
repositories that are discovered implicitly by walking up the directory
tree. Bare repositories specified via --git-dir or GIT_DIR continue to
work, and directories that look like .git, worktrees, or submodule
directories are unaffected (the existing is_implicit_bare_repo()
whitelist handles those cases).

Users who rely on implicit bare repository discovery can restore the
previous behavior by setting safe.bareRepository=all in their global or
system configuration.

The test for the "safe.bareRepository in the repository" scenario needed
a more involved fix: it writes a safe.bareRepository=all entry into the
bare repository's own config to verify that repo-local config does not
override the protected (global) setting. Previously, test_config -C was
used to write that entry, but its cleanup runs git -C <bare-repo> config
--unset, which itself fails when the default is "explicit" and the
global config has already been cleaned up. Switching to direct git config
--file access avoids going through repository discovery entirely.

Assisted-by: Claude Opus 4.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>