prepare changelog for upcoming release

<!-- agent -->
Reject file-reading options passed to blame, diff, and tag APIs. Inspect
positional values after resolving aliases, recognize unsafe options
behind command-specific short-flag clusters, and retain the explicit
allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and
GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink.

Regression tests cover long, short, and clustered options, incremental blame,
tag path/reference positionals, the ref keyword alias, both diff entry points,
and preservation of diff pickaxe behavior.

Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Block file-reading Git options

This is done by calling into `git hash-object` for correctness, instead
of using a mostly incorrect custom implementation for this (lacks filters).

<!-- agent -->
GitCmdObjectDB inherited LooseObjectDB.store(), so despite its name, object
writes bypassed Git and used gitdb's loose-object implementation. That path
creates and chmods object files itself, which can fail during Index.add() on
filesystems where those permission changes are unsupported.

Override store() to stream new objects through `git hash-object -w --stdin`.
This lets Git manage object creation and permissions consistently with the
repository configuration. Retain the inherited implementation for pre-hashed
objects and custom output streams, whose existing semantics hash-object cannot
provide.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
Repo.clone() and Repo.clone_from() did not reject the clone option that
redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc).
Regression coverage exercises both keyword and multi-option input through both
public clone APIs.

Add the option to the existing clone denylist, matching Repo.init()
and the documented allow_unsafe_options contract. Git itself registers

The Python package and Alpine test workflows failed across the submodule suite
because GitPython internally supplies --separate-git-dir when creating modern
submodule layouts. The new public clone guard correctly rejected that option,
but could not distinguish the library-generated path from caller input.

Validate caller-provided keyword and multi-options before adding the
library-controlled metadata path, then explicitly allow the resulting trusted
clone invocation. This preserves rejection of unsafe clone_multi_options while
restoring normal submodule creation. Update the one test that intentionally
invokes Repo.clone_from() with its own separate git directory to opt in
explicitly.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>
Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

index: write blobs via git hash-object, not gitdb's odb.store

…ption

Block separate git directories during clone

<!-- agent -->
GitConfigParser decoded valid multiline values into embedded newlines, but
_write() serialized those newlines as indented physical lines. Rewriting an
otherwise unchanged config could therefore change its meaning to Git.

Serialize resident multiline values with Git-compatible escapes inside a
quoted continuation, preserving GitPython read compatibility while keeping
each option structurally intact. This addresses GHSA-284h-m62q-gf8w.

The regression starts with an inert multiline value, performs an unrelated
write, and verifies with both GitPython and git config that it remains one
value and does not create another option.

Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape
embedded LF as \\n rather than emitting it as a physical config line.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
Submodule configuration is read from .gitmodules, whose contents may come
from an untrusted repository. Its parser inherited merge_includes=True and
could therefore open files named by include directives during ordinary
submodule enumeration.

Disable include merging at the SubmoduleConfigParser construction site. This
matches Repo.config_writer() hardening from 41ecc6a and addresses
GHSA-7833-fr7j-v32q without changing include behavior for trusted config
parsers.

The regression points .gitmodules at a non-config file and verifies the
submodule entry remains readable without opening the included path.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

fix: harden config parsing boundaries

prepare changelog prior to release