Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964

Context

Copilot raised this on #2963, the pull request closing #2951. It is an over-denial that change introduced, filed here under that pull request's stop rule rather than chased there, since it trades no safety for the precision it would add.

A Branch Pattern's Operations Reach an Explicitly Named Branch

#2963 reads a lone : refspec, and a branch pattern such as +refs/heads/*:refs/heads/*, as writing every protected default and each branch named beside it, with the pattern's own operations. Git gives an explicitly named refspec precedence over a pattern for a ref both match, so in git push origin '+refs/heads/*:refs/heads/*' feature/y the feature/y update is not forced. The guard reads it as forced, so a non_fast_forward rule on feature/y denies a push git would carry out as an ordinary update or reject on its own. A pattern with a fixed prefix, such as refs/heads/feature/*:refs/heads/feature/*, also reaches the protected defaults it cannot match.

Possible Direction

Pair each pattern's operations with the branches it can match, leaving an explicitly named branch to its own refspec's operations, and skip a protected default a fixed prefix rules out. Any narrowing here removes a deny, so it needs the develop-versus-branch differential the guard's other narrowing changes ran, showing no new allow.