docs(git): state --repository confinement in --help and validate_repo_path - #5454

Closes #5230

Description

mcp-server-git --help described --repository only as "Git repository path", so nothing in the CLI said that leaving it out puts every reachable repository in scope. This PR:

• rewrites the --repository option's help (src/git/src/mcp_server_git/__init__.py) to say it confines operations to the repository (a path inside it selects the whole repository, matching the startup walk-up to the root) and that without it every repository the server process can reach is in scope;
• documents the allowed_repository is None behavior in validate_repo_path's docstring (server.py; that docstring only);
• extends test_main_help (tests/test_entrypoints.py) to assert both sentences appear in --help, comparing with whitespace collapsed because Click wraps option help to the terminal width.

The README half of the issue already shipped in #5225: src/git/README.md → Configuration carries the bolded "Without --repository, the server reads and writes any Git repository the server process can reach" paragraph, so the README is unchanged here rather than duplicating it.

Server Details

• Server: git (mcp-server-git, Python)
• Changes to: the --repository CLI help text, one docstring, one test. No tool, prompt, schema or behavior change.

Motivation and Context

#5230: users launching uvx mcp-server-git without --repository may assume the server is scoped to the workspace. The README now says otherwise (#5225); this brings --help in line.

How Has This Been Tested?

uv run --frozen mcp-server-git --help on this branch:

Usage: mcp-server-git [OPTIONS]

  MCP Git Server - Git functionality for MCP

Options:
  -r, --repository PATH  Git repository to confine operations to (a path
                         inside it selects the whole repository). Without this
                         option, every repository the server process can reach
                         is in scope.
  -v, --verbose
  --help                 Show this message and exit.

On v2/main the same line reads -r, --repository PATH Git repository path.

• uv run --frozen pytest tests/test_entrypoints.py: 15 passed, including the extended test_main_help.
• npm run local:gate: exit 0 (every stage, both languages, including the git server's coverage gate and the boot smoke).

No LLM client run: the change is the CLI help text and a docstring, neither of which an MCP client ever sees; the server's protocol surface is byte-for-byte unchanged.

Breaking Changes

None. The option's name, short form and behavior are unchanged.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follow MCP security best practices
• I have updated the server's README accordingly (not applicable: the README warning already shipped in git: README should state plainly that without --repository every reachable repository is in scope #5225; nothing in it is inaccurate after this change)
• I have added a changeset (npm run changeset) if this changes what a TypeScript server publishes (not applicable: Python server)
• I have tested this with an LLM client (not applicable: help text and a docstring only, invisible to an MCP client)
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (not applicable: no new code paths)
• I have documented all environment variables and configuration options

🤖 Generated with Claude Code