dot-ssh-config

Host yale-bastion
  HostName YOUR-ON-CAMPUS-MACHINE.yale.edu
  User YOUR-NET-ID
  ForwardAgent yes
Host yalegit
  HostName git.yale.edu
  User YOUR-NET-ID
  ProxyCommand ssh yale-bastion -W %h:%p

Awesome, super helpful, necessary, informative. In order to use the solution successfully for my needs, I did have to make a few changes:

.ssh/config :

Host yale-bastion
   HostName [ON_CAMPUS_HOST (the zoo for us)]
   User [USER_NAME (netID for us)]
   ForwardAgent yes
Host yalegit
   HostName git.yale.edu
   User git
   ProxyCommand ssh yale-bastion -W %h:%p

.git/config :

[remote "origin"]
        url = git@git.yale.edu:[REST-OF-SSH-URL-OF-REPO]
        fetch = +refs/heads/*:refs/remotes/origin/*
[remote "yalegit"]
        url = yalegit:[REST-OF-SSH-URL-OF-REPO]
        fetch = +refs/heads/*:refs/remotes/origin/*

I wanted to substitute netID@campus-host for git@git.yale.edu, so rather than specifying the user and host in .git/config, I simply referred to the proxy definition 'yalegit'. Before, it either kept trying to connect me to the wrong proxy (git@zoo) or the wrong repo (netID@repo-name). I hope that helps other readers who may also need to adapt your code.

tldr; this was a life saver. I'm in a group currently building app on AWS that is for class (otherwise we wouldn't have used yale git), so this was the only way we could possibly use git in production. We were getting close to just SCP'ing our repo to the EC2 instance after every pull. Honestly, ITS should reconsider the need to be on yale's network to access yale git-- people should learn how to use their own RSA keys effectively anyway.