Define safe Git branch switching for executable repository filters

**What problem would this solve?**

The desktop app switches branches by invoking `git checkout` inside the selected repository. Git may execute repository-local hooks and configured smudge/process filters while materializing the branch, so a navigation action can run native commands that are not visible in the Goose UI.

**What would a good outcome look like?**

Branch switching has an explicit repository-trust model and does not unexpectedly execute untrusted native commands. Legitimate Git LFS and custom-filter users have clear, intentional behavior rather than silent breakage.

**Possible approaches**

- Run checkout with hooks disabled and an isolated configuration that suppresses executable filters.
- Detect executable hooks or filters and require an explicit repository-trust confirmation before switching.
- Limit the built-in switcher to repositories whose materialization does not require native filter commands, with a clear fallback to an external Git client.

The design should separately cover post-checkout hooks, smudge/process filters, Git LFS, local versus global configuration, and existing trusted repositories.

**Additional context**

- [x] I have verified this does not duplicate an existing feature request

Do not begin implementation until the issue reaches **Ready** on the [Goose Issues board](https://github.com/orgs/aaif-goose/projects/1).