How safe it is that a single San Francisco company controls the canonical location of Bitcoin code? The single most-trusted canonical source of Bitcoin client is https://github.com/bitcoin/bitcoin

This URL is controlled by a single US company GitHub Inc., headquartered in San Francisco, United States. The US government (nor any other government) is probably not a friend of Bitcoin, and they could theoretically threat the CEOs of GitHub Inc. with an arrest, unless they implement some kind of backdoor into the Bitcoin code, which could be downloaded by a large number of people before it would get noticed.

If and how is the Bitcoin network protected from being poisoned and destroyed this way?
You should learn more about the way the git scm system works. First, it is distributed so that everyone has a complete copy of the entire codebase; second, every commit is checksummed, so that if github wanted to (or was forced to) underhandedly change code, it would be detected by everyone.