Make test git isolation structural: runGit helper + forbidigo rule

[Soph]

#2171 isolated the 38 git invocations in cmd/entire/cli/strategy/hooks_test.go by assigning cmd.Env = testutil.GitIsolatedEnv() at each call site. That closed the leak in that file, but by repetition - nothing prevents the 39th call site from omitting it, which is the exact failure #2171 was repairing.

Sixteen sibling sites remain unisolated:

• cmd/entire/cli/review/scope_test.go (6)
• cmd/entire/cli/gitrepo/gitstatus_guard_test.go (3)
• cmd/entire/cli/strategy/commit_hook_perf_test.go (3, behind //go:build hookperf)
• singles in review_context_test.go, integration_test/resume_test.go, checkpoint/redact_cache_scope_test.go, checkpoint/remote/git_test.go

Without isolation these read the developer's global gitconfig. #2171 demonstrated the consequence: with init.defaultBranch=feature set globally, four tests in hooks_test.go failed with an opaque failed to create worktree: exit status 255.

Suggested: a file-local or package-level runGit(t, dir, args...) helper that bundles the Env assignment and the repeated error check, then a forbidigo rule for bare exec.Command(..., "git", ...) in _test.go files - the same mechanism already used to keep callers off worktree.Status().

[TridipDam]

Hii, I'd like to take this issue and work on a PR for it. Could you assign it to me? Thanks.

[Soph]

@TridipDam go for it

[TridipDam]

Hi Soph, I see PR #2214 addresses the remaining git isolation gaps for #2202. Since I was assigned this issue earlier, should I continue working on #2202, or should take another issue?