>If the handful of devs that have commit access to Bitcoin were working for the CIA, would we know?

probably not, unless they're comically incompetent

>What kind of damage could they do? Eg. Could they introduce consensus bugs without anyone noticing?

not much, considering there are independent implementations, there's no auto-update for clients, and consensus code changes are heavily scrutinized. I'm sure they can ram a PR through if they really wanted, but it's going to be very obvious what's happening.