ai: apply changes for #862 (1 review thread)

Addresses:
  - #3599286278 at .bot/config.yaml:68

Author: peco-engineer-bot[bot]

.bot/config.yaml

@@ -49,13 +49,21 @@ pr_body_template: |-
 #     the workflow BEFORE the agent, so the venv exists; the agent runs the suite
 #     to self-verify its red→green fix. Bare `python -m pytest` is also allowed
 #     for when the active interpreter already has the deps.
-#   - `git diff` is pinned to HEAD-relative / index forms. A bare (git,diff)
-#     prefix would allow `git diff --no-index /etc/passwd /dev/null`, reading
-#     arbitrary ABSOLUTE paths and bypassing safe_path. Pinning to `HEAD` also
-#     defeats the `git diff HEAD --no-index <abs> <abs>` prefix-match variant:
-#     with a revision (HEAD) present git is in tree-diff mode and rejects paths
-#     outside the repo (`fatal: '<path>' is outside repository`), so --no-index
-#     cannot escape the worktree — verified on the runner.
+#   - The diff/log-GENERATING git subcommands (`git diff`, `git log`) are
+#     deliberately ABSENT. They all honor the shared `--output=<file>` diff
+#     option, which performs NO repo-containment check: `git diff HEAD
+#     --output=/abs/path` (and the `--cached` / `git log -p` variants) OVERWRITES
+#     an arbitrary absolute path on the runner (e.g. ~/.bashrc, ~/.gitconfig).
+#     Prefix matching cannot block a trailing `--output` — args after the prefix
+#     are model-supplied — and issue bodies are untrusted input, so a
+#     prompt-injected agent could be steered into it. This arbitrary-WRITE escape
+#     is worse than the `git diff --no-index` arbitrary-READ escape, so — exactly
+#     as with cat/ls/find below — the primitive is removed rather than pinned
+#     (no prefix form can express "diff but never --output"). Confirmed on the
+#     runner that `git diff HEAD --output=<path>` writes the file.
+#   - `git status` is KEPT: it generates no diff and accepts no `--output`, so it
+#     is a safe way to list changed files. The agent inspects its own work via
+#     read_file / glob / grep (repo-relative, safe_path-contained) plus that list.
 #   - `cat`, `ls`, `find` are deliberately ABSENT — they read arbitrary absolute
 #     paths (the bash tool validates only the argv PREFIX, not path args). The
 #     agent has read_file / glob / grep for repo-relative reads, all safe_path-
@@ -65,9 +73,6 @@ bash_allowlist:
   - [poetry, run, python, -m, pytest]
   - [python, -m, pytest]
   - [python3, -m, pytest]
-  - [git, diff, HEAD]
-  - [git, diff, --cached]
-  - [git, log]
   - [git, status]
 
 # Author phase. The user prompt is ENGINE-RENDERED from the convention template