Redacted excerpt; full evidence withheld.

$ cd <host-path> && git log -1 --format=%H 2>/dev/null; ls -la; cat README.md 2>/dev/null | head -200
exit: 0
dNotFound, stderr suppressed) in sh/bash. For cmd.exe: `|| exit 2` is
the native short-circuit.

**What was measured in the VM (Windows 11 ARM64, 2026-10-06):** PowerShell 5, cmd.exe,
and Git Bash (non-login, explicit PATH to the branch binary) all block
`git push origin main` (exit 2) and allow `ls` (exit 0) correctly. `pwsh` (PowerShell 7)
was not installed on the VM — not measured. Subsequent testing with real agent CLIs on the
same VM proved end-to-end blocking and allowing for two CLIs; the remaining CLIs have the
hook line verified in each shell but were not run agent-to-end:

[excerpt truncated]