git: flag-injection guard messages reach the client wrapped as "Ref ... did not resolve to an object" #4999

Problem

The flag-injection guards raise BadName, so their own message reaches the client wrapped in GitPython's Ref '<message>' did not resolve to an object. The rejection works; the message is garbled.

Where it is pinned

src/git/tests/test_protocol.py: test_git_diff_rejects_flag_injection, test_git_create_branch_rejects_flag_injection, test_git_checkout_rejects_flag_injection, test_git_show_rejects_flag_injection, test_git_branch_rejects_flag_injection, added in #4974 (Wave 1 of #4857). Each of these tests carries a KNOWN BUG marker: it asserts the current, wrong behavior, so the fix has to change it.

Expected

The client sees the guard's message as written. Keep the rejection itself, which test_server.py guards.

Done when

• The behavior above is fixed, in the legacy-era (2025-11-25) server on SDK 1.x.
• The pinning tests assert the correct behavior, and their KNOWN BUG markers are gone.
• The per-file 90% coverage gate still passes.