Build a policy that ignores persisted trust entirely.
For contexts where running repository hooks must be an explicit opt-in rather than something a previous interactive session can enable — notably headless runs, where the operator may never have seen the interactive trust prompt.
Directory the trust decision was made for.
Whether project hooks were explicitly opted into.
Alternate trust store path for tests.
