[Bug] File write restrictions inconsistently applied to Git-related filenames outside .git directory

**Bug Description**
writing to files named `config`, `HEAD`, etc. that are relevant to Git gets blocked in a sandbox but not in the `.git` folder but actually in the sandbox root

**Environment Info**
- Platform: darwin
- Terminal: xterm-256color
- Version: 2.1.236
- Feedback ID: 0a1405cc-009c-4dfa-b9e3-6bd77d58e865

**Errors**
```json
[]
```

Start by reproducing the behavior on darwin with version 2.1.236, comparing writes to Git-related filenames in the sandbox root with equivalent writes inside the .git directory. Trace the sandbox file-write restriction entry point once the differing paths are identified. Done means the restriction is applied consistently to the described filenames and the regression is covered by a reproducible test.

由索引模型根据 Issue 内容生成。