Derrick Stolee [off-list ref] writes:
* 'no-embedded' allows non-embedded bare repositories. An
_embedded bare repository_ is a bare repository whose parent
directory is contained in the worktree of a non-bare Git
repository. When in this mode, embedded bare repositories are
not allowed unless the parent non-bare Git repository has a
'safe.embedded' config value storing the path to the current
embedded bare repository.
Sounds sensible. I wonder how expensive this will be in practice,
but the behaviour seems well thought out.