Could we build in client side encryption of source code inside git, pre-push, and then provide decryption keys to CI services and other software that needs to review code (e.g. in browser decryption)?

We could use pre-shared keys for OSS software available from a separate registry, with a legal disclaimer on there that code hosts cannot use the keys to decrypt the code.

That way github could not physically access your code to run these checks.