@nacin responded to me on Twitter saying the auto-updates are automatically disabled if WP detects that it's being run from within some source control repositories. I asked if it's smart enough to know if it lives deeper within a repository and haven't yet received an answer.