a zipped repo can run code on your machine before you type a single prompt.
the agent runs git status to orient itself. the repo's own .git/config sets core.fsmonitor, and git runs whatever it names.
got a repo as files? read .git/config yourself before an agent opens it.