fix(o79): harden mutating git against repo filters and merge drivers

[QiaolongLi1201]

Summary

O79 — runGit only applied executableConfigOverrides when readOnly was true. All readOnly: false call sites live in worktree-isolation.ts (worktree add, add -A -N, apply --3way, prune, …), so creating a subagent worktree (and related mutating git) still ran untrusted repo .git/config filter.*.smudge / filter.*.clean / merge.*.driver.

Fix

• Always discover and inject executableConfigOverrides in runGit (not only for read-only).
• Keep existing read-only-only behavior for GIT_PAGER=cat, READONLY_CONFIG, and withoutExternalDiff.
• Extend executable-config detection to blank local/worktree merge.*.driver so git apply --3way fails closed instead of running the repo driver.
• Did not touch src/utils/git-config-env.ts (O76 already merged; O80 rewrites that file later).
• Did not change worktree-isolation.ts — the hardening is entirely in git-spawn.ts.

Files

• src/utils/git-spawn.ts
• test/git-spawn.spec.mjs (merge.driver in override unit test)
• test/worktree-isolation-o79.spec.mjs (new)

Acceptance

• QA repro qa-repro-o79-worktree-filter.spec.mjs passes (worktree created, smudge marker absent)
• add -A -N / mutating add path: untrusted filter.*.clean does not run (collectWorktreePatch + runGit(['add','-A'], {readOnly:false}))
• apply --3way path: untrusted merge driver does not run during applyWorktreePatch
• Each of the three cases fails if the readOnly-only gate is restored, passes after this fix
• Base: ed638367 (main tip with fix(o76): always inject core.hooksPath=NUL for untrusted workspaces on win32 #78 O76 + fix(o72): approval-mode copy, no-sandbox notice, once-per-folder untrusted notice #77 O72)

Test plan

npm ci   # Node >= 22.16
npm run test:filter -- --filter worktree-isolation-o79 --filter git-spawn.spec
npm run test:filter -- --filter worktree-isolation.spec
# after build, from a dir whose ../dist is this tree's dist:
node qa-repro-o79-worktree-filter.spec.mjs

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.