Fix pass Git config and lazy OTP commits

docs/git-synchronization.md

@@ -3,7 +3,14 @@
 All Git behavior is implemented in `crates/storage`. IronStorage never launches
 `git`, a credential helper, an SSH client, a hook, a filter, or a merge driver.
 Repositories are opened with isolated configuration and environment access;
-repository-local configuration that could name an executable is rejected.
+repository-local configuration that can affect an operation is rejected.
+Upstream `pass git init` deliberately writes `diff.gpg.binary` and a
+`diff.gpg.textconv` GnuPG command. IronStorage preserves these passive keys for
+compatibility but never evaluates them: it reads Git blobs and renders decrypted
+diffs through Rust storage APIs. Frontends cannot add or change diff drivers.
+This behavior follows the
+[upstream password-store initialization](https://git.zx2c4.com/password-store/tree/src/password-store.sh)
+while keeping runtime helper execution disabled.
 
 `GitRepository` initializes and opens password-store worktrees, selects the
 innermost repository for a nested entry, and implements status, log, diff, add,