fix(guardrails): deny a global git include.path write in block-cross-domain (#12624)

Closes #9750

<!-- session: lane-5 -->

## Summary

The [firing-rate measurement on
#9750](#9750 (comment))
found 0 false positives, so it adds no regression case. Its probe found
one gap: `git config --global include.path <file>` was allowed, though
an include can set the machine's git identity just as an `includeIf`
does.

## Fix

`block-cross-domain` now treats the `include.path` key and the `include`
section as identity writes, with the same forms and reads as the other
identity keys. A repository-local `git config include.path`, which the
repository's own tests use, stays allowed.

## Verification

- `plugins/guardrails/hooks/block-cross-domain.test.sh` before the fix:
81 failing cases naming `include`, from the new key and the
`--remove-section include` case.
- The same suite after the fix: PASS=2556 FAIL=0.
- Left out: the config-directory and auth rules' firing rates, because
discover records no gh or az directories on this host. The rate comes
from a test map, since this host has no production map; the #9750
comment says so.

## Related

N/A

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01VQb9Q1VgLEiwGgRVshK3b7

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: kyle-sexton

.changes/guardrails/fix-9750-include-path-7f807e94.md

@@ -0,0 +1,11 @@
+---
+bump: patch
+---
+
+### Fixed
+
+- deny a global git include.path write in block-cross-domain
+
+  An unconditional include can set the machine's git identity just as an
+  includeIf does, and the guard let `git config --global include.path`
+  through. It now treats the key and the include section as identity writes.