Fix pass Git config and lazy OTP commits

crates/storage/src/git.rs

@@ -2476,20 +2476,16 @@ fn validate_local_config_security(config: &gix_config::File) -> Result<(), GitEr
         let name = section.header().name().to_str_lossy().to_ascii_lowercase();
         if matches!(
             name.as_str(),
-            "include"
-                | "includeif"
-                | "credential"
-                | "filter"
-                | "diff"
-                | "merge"
-                | "protocol"
-                | "url"
+            "include" | "includeif" | "credential" | "filter" | "merge" | "protocol" | "url"
         ) {
             return Err(GitError::InvalidRepository(format!(
                 "unsafe Git configuration section: {name}"
             )));
         }
     }
+    // Upstream `pass git init` installs diff.gpg.binary and
+    // diff.gpg.textconv. IronStorage parses blobs and renders diffs itself, so
+    // these passive settings are preserved but never evaluated or executed.
     for key in [
         "core.hooksPath",
         "core.sshCommand",