populate git: refuse work trees whose .git names places elsewhere

A .git directory names places elsewhere in more ways than being a
symlink or a file: core.worktree, symlinks to a configuration, to
objects, or to refs elsewhere, a commondir file naming another
repository, and linked work trees.  Git's commands follow them, so
fetching, resetting, setting the remote's URL, and cleaning change what
is elsewhere: with core.worktree, git clean removes everything in the
work tree it names.  And Git runs commands the configuration names, like
core.fsmonitor, and hooks.

Populate only uses a work tree whose .git directory has no symlinks, no
commondir file, no linked work trees, and only configuration that git
clone and populate write, where submodules' repositories may have their
work tree in the work tree.  Otherwise populating fails with an error
telling what's wrong, unless the new option reclone replaces the work
tree by a fresh clone.  Git runs without hooks and without fsmonitor in
any case.

The work tree also gets reset to the commit if HEAD is there already: a
lock file rewritten in place, or created and staged by Nix, stays
otherwise once the source stops drawing inputs.

A safety scenario refuses work trees with core.worktree, a symlinked
configuration, a commondir file, and core.fsmonitor, replaces them with
reclone, and checks that a hook doesn't run.  A git scenario stops
drawing inputs and checks that the work tree is clean.

1 files changed, 12 insertions, 0 deletions

diff --git a/README.md b/README.md
index 1b7e29e..969afcd 100644
--- a/README.md
+++ b/README.md
@@ -309,6 +309,13 @@ everything else.  It doesn't change or remove anything outside:
   is a symlink, or a file naming a repository elsewhere, gets replaced by a
   `git` source as well.
 
+* A `git` source only uses a work tree whose `.git` directory contains no
+  symlinks, no `commondir` file and no linked work trees, and only the
+  configuration that `git clone` and populate write.  Otherwise Git's
+  commands could change what's elsewhere, or run commands, so populating
+  fails, telling what's wrong, unless the source's `reclone` is set.  Git
+  runs no hooks.
+
 * Populate keeps its state in the sentinel, `.populate`, which becomes a
   directory once there is state to keep.  Populating fails if the sentinel,
   or a directory populate needs therein, is a symlink.
@@ -556,6 +563,11 @@ Supported attributes:
   boolean that controls whether only the requested commit ref. should be fetched
   instead of the whole history, to save disk space and bandwith. Defaults to `false`.
 
+* `reclone` (optional) -
+  boolean that controls whether a work tree populate can't use, see
+  [The target directory](#the-target-directory), gets replaced by a fresh
+  clone, instead of failing.  Defaults to `false`.
+
 * `inputs` (optional) -
   inputs of the flake in this source to draw from other sources, see
   [Flake inputs from sources](#flake-inputs-from-sources).