outboundEnv: include.path, GIT_CONFIG_GLOBAL/SYSTEM and remote.<name>.proxy still redirect git (follow-up to #1082) #1084

Follow-ups from the adversarial review of #1082 (R82b, PASS at bf038f1). All three are on main today; #1082 neither adds nor fixes them.

1. include.path / includeIf.*.path through GIT_CONFIG_KEY_n still bring in a config file whose url.*.insteadOf rewrite git applies (measured by R82b against git 2.43 with a local temp repo: the rewrite to a local repo happened). outboundEnv should strip include keys like the redirect keys, or refuse them.
2. GIT_CONFIG_GLOBAL and GIT_CONFIG_SYSTEM pass through outboundEnv unchanged and can point git at a file with the same redirect/TLS settings (inferred from code; same mechanism as 1).
3. remote.<name>.proxy isn't in the stripped set (inferred from code).

Test gaps (mutants that survived):

• The tests' status != 0 check can't tell "git refused the count" from "key not found"; assert on git's "bogus count" message instead.
• A count of exactly 1000 and an empty count are untested at the boundary.

Critical set: yes (outbound env guard). Fail closed: strip or refuse.