Agent-Safe Commit Guardrails