integrity of a repository

[Ralf Wildenhues <Ralf.Wildenhues@gmx.de>]

Hello giters,

I am aware that git provides integrity of a commit (and thus, a branch
head) via its sha, which covers both the tree and its history.

But what about the integrity of a git repository as a whole?

For example, if I have a set of branches, create a file listing
  branchname  sha-of-head

for each such branch, and hash that file, and also 'git gc --prune',
can I then be sure that not only does the repository contain exactly
what I want (namely all history of all branches), but also that it does
not contain any other material (say, stuff that may not be disclosed)?

Would I need the in file listing all local and remote branches?
What about all heads in .git/*HEAD (such as FETCH_HEAD)?

Thanks,
Ralf