[3np]

Gitolite/gogs/gitea should all be capable to enforce policies like what you described.

If your concern is data loss/malware, anything on the git level is going to be insufficient (but can still be useful of course, as you said)

I’d echo the suggestion of zfs snapshots replicated on a separate mirror of disks. I can recommend zrepl to set up the snapshotting/replication/pruning part. Syncoid is another popular one.