--allow-tool shell(git) does not blanket-allow all git subcommands — only a narrow undocumented subset is covered

--allow-tool shell(git) does not blanket-allow all git subcommands — only a narrow undocumented subset is covered #1309