Function get_from_lfsconfig 

pub fn get_from_lfsconfig(
    cwd: &Path,
    key: &str,
) -> Result<Option<String>, Error>

Look up key in .lfsconfig, applying the safe-key allowlist.

The first call per cwd per process loads + filters .lfsconfig, caches the result, and emits the warning: These unsafe '.lfsconfig' keys were ignored: line that t-config 9 / upstream’s config loader produces. Subsequent lookups hit the cache.