fix(security): scrub GIT_CONFIG_COUNT and secrets from checkpoint git env

[zapabob]

Summary

• Salvage: fix(checkpoints): isolate shadow git repo from user's global config (GPG pinentry popups) #11261 / existing checkpoint isolation nulls GIT_CONFIG_GLOBAL/SYSTEM, but Git still honours GIT_CONFIG_COUNT / GIT_CONFIG_KEY_* / GIT_CONFIG_VALUE_* from the parent environment, allowing config injection (e.g. core.sshCommand) during background snapshots.
• Also strip GIT_SSH_COMMAND / askpass / proxy wrappers and build the env via hermes_subprocess_env(inherit_credentials=False) so provider API keys are not visible to git credential helpers.
• Init path uses the same scrubbing.

Test plan

• pytest tests/tools/test_checkpoint_manager.py::TestGpgAndGlobalConfigIsolation (5 passed)

[teknium1]

Thanks for hardening the checkpoint Git environment. The premise is still present on current main: tools/checkpoint_manager.py:264 and :449 use build_subprocess_env(scrub_secrets=False, ...), preserving inherited Git configuration and provider credentials.

Problems

• The proposed cleanup omits GIT_CONFIG_PARAMETERS. Git honors it as configuration: GIT_CONFIG_PARAMETERS="'core.pager=cat'" git config --get core.pager returned cat during review. This leaves an environment configuration-injection path after the proposed GIT_CONFIG_COUNT / key/value cleanup.
• tests/tools/test_checkpoint_manager.py adds dictionary assertions only. It does not execute a real Git child, despite this being a security-boundary change.

Suggested changes

• Rebase the implementation concept onto the current build_subprocess_env call sites introduced by 3d48f893da, with secret scrubbing enabled and explicit removal of GIT_CONFIG_PARAMETERS alongside the count/key/value variables in both _git_env and _init_store.
• Add a real Git-path test for all supported inherited configuration mechanisms.

Automated hermes-sweeper review.

[andrexibiza]

Bound to the child-process credential-inheritance class under #83565 (#83565) — same bug class, different surface. checkpoint git env (GIT_CONFIG_COUNT + secrets); Wave F — independent surface. The EPIC carries the live class table, dedup adjudication, and the dependency-driven merge order.

[zapabob]

Rebased the checkpoint Git environment fix onto frozen official-main anchor 8e475ed27b1199b8d0bbf094cf2e15fcd555f8cf as 3db9c54c13dede743b4ebedea7aa61d510dcf2f8. The current build_subprocess_env call sites in both _git_env and _init_store now use secret scrubbing and explicitly remove GIT_CONFIG_PARAMETERS, GIT_CONFIG_COUNT, indexed config keys/values, SSH/askpass/proxy wrappers, and diff helpers.

Added a real Git child regression: an inherited GIT_CONFIG_PARAMETERS / count-key-value injection cannot make git config --get core.pager succeed. Added direct assertions for credential wrappers and provider-secret removal.

Validation: the two new focused tests pass (2 passed, 47 deselected); explicit .venv/Scripts/python.exe -m py_compile, git diff --check, and fixed-anchor ancestry pass. The existing test_env_pins_store_worktree_and_ignores_ambient_git_state still fails on the fixed Windows baseline because it expects POSIX slash spelling for a native Windows path; that failure reproduces before this patch and was not changed. GitHub checks are pending for the new head.

[zapabob]

Rebased onto the current official main fixed at 7a54ab2; new head d5d08b5.

The checkpoint Git child environment still removes Git config injection variables, credential wrappers, and provider secrets. Local evidence after the replay: focused regressions 2 passed (47 deselected), Python compile passed, and git diff --check passed. Required GitHub checks are running for the new SHA.