Handling the 'default/' folder in Git
The answer from @leymannx stops git from recognizing and pushing file permission changes to the repository.

Yet, it doesn't stop Drupal from denying write access to the configuration files after your cache cleared, and thus a git pull to fail if it can't write changes to these files.

As the permissions set automatically by Drupal still allow write access for the file owner, the easiest solution would be running git pull with the same user that is running the local webserver.

If that is no option, your developers may try to use access control lists (setfacl) for advanced write permissions to their local sites folders on Linux systems.

Another option would be to wrap the git executable with a custom shell script in their local binary paths, that ensures proper write permissions (unfortunately there's no pre-pull git hook).

As a last resort, you can patch the core. There is lots of discussion of whether and how to allow developers to circumvent file protection for setting files. None of the proposed solutions made it to core yet. But the patch from this issue for Drupal 7 allows a custom setting in your local development environment settings (e.g. in settings.local.php) to disable file permission changes.