Each bug is stored independently and in particular independently of the source code, so older bugs could be archived or simply left on the git remote.

I don't see your point about the permission model.

You will have access permission for the code as you normally do for your git remote as well as an extra user for the web UI that will store bug edits as one of the "public" user with whatever external authentication system you want.