Function assert_only_allowed 

pub fn assert_only_allowed(
    root: &Path,
    allowed: &[PathBuf],
    globs: &[String],
    stage_ignored: bool,
) -> Result<Vec<PathBuf>>

Fail if the worktree has dirty paths outside allowed and globs.

Returns dirty paths that match globs (modified, untracked, or deleted files). Directories are skipped. Same git status walk as the unexpected-dirty check; not a filesystem glob.