Fetch, strip, inspect, then confer git-ness

securegit acquire <url> <destination>
securegit acquire <url> .

1. The remote is resolved and the content is fetched as an archive, not as a live repository. No git configuration is active at any point during transfer.
2. The archive is extracted to the destination.
3. Hooks are stripped. Not disabled, not renamed — removed.
4. The configured scanners run across the extracted tree.
5. A report is written to .securegit-report.json in the destination.
6. The tree is converted into a normal git repository, with history.
7. A chain receipt is emitted recording the remote URL and the resolved HEAD at acquisition time. Acquisition never blocks on receipt failure.

ShippedThe receipt records what you got, from where, at what commit, at what time.

Later, if the upstream force-pushes and history changes underneath you, your receipt still says what you actually received. That is a surprisingly practical thing to have and it costs nothing at acquisition time.