[Tyrie Vella (tyrielv)]

Problem and Context

The command hook still takes the global GVFS lock for several commands that do not change index membership or tracked checkout content.
During that lock, unrelated first opens of projected files can fail with FileNotFound.

This includes reflog, whose write modes change refs and reflogs rather than the index or tracked files.
Other commands need mode-specific checks because some options refresh the index, overwrite an input file, or dispatch an arbitrary program.

Those checks depend on exact argument boundaries.
The native hook loader currently joins arguments without quotes, so a value with spaces can appear as a false mode or option separator.

Changes

• Exempt all reflog modes, including ref updates and the read-only index traversal for expire --stale-fix.
• Exempt bundle, format-patch, notes, and replace. Their output files and configured helpers use the same trust boundary as existing exemptions.
• Exempt commit-tree, merge-tree, mktag, mktree, pack-refs, and update-server-info for object and ref operations.
• Exempt column, diff-pairs, fmt-merge-msg, format-rev, get-tar-commit-id, last-modified, patch-id, pickaxe, show-index, stripspace, url-parse, and var.
• Exempt known safe options for describe and grep. Keep locks for dirty/broken descriptions, pager dispatch, abbreviated options, and unknown options.
• Exempt merge-file only with a recognized stdout or object-output mode. Keep locks when an option disables that mode.
• Exempt the current ref-only refs subcommands. Keep locks for migrate and unknown subcommands.
• Preserve external-program and alias resolution. Parse option values, combined short options, and appended hook metadata before a partial exemption.
• Quote each forwarded hook argument with Windows argument rules. Preserve spaces, tabs, embedded quotes, empty values, and trailing backslashes.
• Preserve the configured hook command prefix and require separate hook metadata for partial exemptions.
• Add unit tests for both hook phases, new command names, mode overrides, option values, abbreviations, and external names.
• Add functional tests that verify lock bypass and retained waits under controlled contention.
• Add functional tests that pause the post-command chain and open an unmaterialized file from another process.
• Add a functional test that performs reflog writes under contention and verifies unchanged index bytes, index timestamps, and staged/modified file content.
• Add functional tests that verify native argument round trips and retained locks for quoted patterns and merge labels.

These exemptions do not provide snapshot isolation. Ref locks remain in effect, and configured helpers retain the existing command policy's trust assumptions.

Validation

An original-loader negative control splits ours -p into two arguments.
The new loader preserves the argument and prevents that partial-exemption bypass.