Add read-only git tools (git_show/git_diff/git_log) to the child-safe tool surface

[tt-a1i]

Problem

Child agent types reviewer and advisor (tools: read grep find ls fd rg) have no way to inspect git history. In a real review session (OpenPI running on itself, review of PR #60's branch), both reviewer subagents explicitly reported (translated):

"This session has no shell/exec tool and cannot run git show. The review is based on a full read of the HEAD working tree… all conclusions that depend on comparing against old code are marked as uncertain."

They could only review the final state of the tree, not the diff. Every claim about "behavior changed vs before" had to be cross-derived from a prose description the parent supplied, and the parent had to redo the diff review itself before merging.

Why this matters

• Review is the highest-leverage use case for read-only child agents, and its primary artifact is a diff.
• The parent can't fix this by steering: the reviewer's tool restriction correctly excludes bash, so there is no way to grant git access without weakening the boundary.
• The current CHILD_SAFE_PACKAGE_TOOL_NAMES allowlist is exactly the right mechanism — it just lacks the capability that reviews need most.

Proposal

Add a small read-only git surface as package tools, classified child-safe. Minimal set:

• git_show (commit contents, one revision)
• git_diff (two refs, or ref vs worktree)
• git_log (bounded output, e.g. --oneline + max count)

Constraints to respect (per the repo's own discipline):

• Read-only, fail-closed on anything that would write (validate the subcommand shape; don't shell out with interpolated strings).
• Must be registered in CHILD_SAFE_PACKAGE_TOOL_NAMES so the drift guard in child-session.test.ts stays authoritative.
• Follow the existing file-search pattern (structured schema, bounded output, spill-to-file on truncation).