feat: add pre-execution safety review prompt

Asks users to confirm they've reviewed the script before it modifies
config. On decline, prints instructions for piping the script to
Claude Code or Gemini CLI for a security review. Skipped with -y
and --audit flags. 3 new tests (53 total).

Closes: #7

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

test/git-harden.bats

@@ -619,6 +619,44 @@ SSHEOF
     grep -q "transfer.fsckobjects=true" "$backup_file"
 }
 
+# ===========================================================================
+# Safety review gate
+# ===========================================================================
+
+@test "safety gate is skipped with -y" {
+    source_functions
+    AUTO_YES=true
+    AUDIT_ONLY=false
+
+    run safety_review_gate
+    assert_success
+    refute_output --partial "Safety Review"
+}
+
+@test "safety gate is skipped with --audit" {
+    source_functions
+    AUTO_YES=false
+    AUDIT_ONLY=true
+
+    run safety_review_gate
+    assert_success
+    refute_output --partial "Safety Review"
+}
+
+@test "safety gate exits 0 with instructions when user says no" {
+    source_functions
+    AUTO_YES=false
+    AUDIT_ONLY=false
+
+    # Override prompt_yn to simulate "no" answer
+    prompt_yn() { return 1; }
+
+    run safety_review_gate
+    assert_success  # exit 0, not an error
+    assert_output --partial "claude"
+    assert_output --partial "gemini"
+}
+
 # ===========================================================================
 # End-to-end: --audit mode
 # ===========================================================================