I don't want to go down a bike shedding path here, but I feel like keeping challenges for a ~week would put us in a better position the first time someone wants to debug this stuff.

Requested changes.

Accepted assuming my inlines aren't actual issues.

Move logging in PhabricatorUserDisableTransaction.

Override requireCapabilities to correctly check permissions.

Also note that this is a slight behavior change, because it is now possible to "unapprove" an already-approved user (primarily by using Conduit). The effects of this change are left as an exercise for the reader, but PhabricatorPeopleDisableController, for example, won't let you disable a user that has already been approved.

Repeated code.

New appearance:

Change format string to match "hours:minutes", rename variables for clarity.

Change variable name.

Switch to strlen.

When you fix the error and submit again, you have to do another MFA check.

This was kinda big to review, so I read everything and then spot-checked some of the cut/paste changes from PhabricatorRepositoryEditor.php to make sure they ended up in the right places instead of exhaustively going back and forth.

Some testing comments:

• Commits that touch a ton of files? I just wonder if there's any limit to the input that git diff-tree and git cat-file will accept.
• Commits that delete files? Not sure if these commands do anything goofy on deleted files, and in theory they should still work since the underlying objects should still exist in the object DB. As a micro-optimization we could skip checking deletes entirely by (I think) checking the "change mode" output from git diff-tree.
• Races on git repack? Are we worried about git commands that reorganize the object DB on disk running concurrently with these commands (see question about objectsize vs objectsize:disk).