fix: classify submodule operations and block unbound/foreign writes

[suzuke]

Problem

The shim does not explicitly classify submodule or submodule--helper.

• Plain git submodule update --init falls through the unknown-subcommand default. In an unbound throwaway fixture it reached real git and wrote submodule.<name>.url to .git/config.
• Plain direct git submodule--helper ... also reaches real git.
• git -C <worktree> submodule status is falsely denied because submodule is absent from KNOWN_SUBCOMMANDS.
• Merely adding it to KNOWN_SUBCOMMANDS is unsafe: submodule writes are also absent from is_mutating_local, so a bound -C <foreign-worktree> submodule update could retain the foreign target and mutate another worktree.

Required policy

• Explicitly classify submodule and direct submodule--helper.
• Read-only: bare/status/summary, including supported option forms.
• Mutating: update/init/deinit/add/set-url/set-branch/sync/foreach/absorbgitdirs.
• Unknown future submodule operations default deny.
• Direct agent invocation of submodule--helper is denied/write-class; normal real-git internal helpers use GIT_EXEC_PATH and must continue working.
• Add submodule write forms to is_mutating_local, preserving bound-worktree redirection and foreign-target protection.

Acceptance tests

Hermetic nested file:// fixture covering plain / -C own / -C foreign × bound / unbound:

• read forms work;
• unbound writes deny before .git/config, .git/modules, or worktree mutation;
• bound writes affect only the bound tree;
• foreign tree stays byte-identical;
• direct helper is denied;
• known-subcommand/classifier/mutating-local mirror invariants prevent list drift.

AgEnD decision: d-20260713022337704151-9. Fix must land upstream first; agend-terminal will update its gitlink separately.