git-apply
Policy-gated preflight for applying untrusted unified diffs in CI and agent sandboxes: parse, gate paths against escape/symlink/deny rules, git-apply --check, then apply.