Hardened the git check-ignore probes to run under the isolatedGit exec pins (core.hooksPath, core.fsmonitor).

Frontmatter

.abcd/work/issues/resolved/iss-2608270735420161-hardened-the-git-check-ignore-probes-to.md
open on GitHub ↗ · commit history ↗

mentions2

• iss-2609012039114437GHSA-h2gm-w3hm-8xpq ledger marker: the advisory (git check-ignore probes executing a repo-local core.fsmonitor) was fixed before this run by 15a31ea7104a82b5af999ab7ee3a28dac9a0a4a5 "fix(gitutil): pin core.fsmonitor off on check-ignore probes" (plus 742e2f44 allow-listing the test in the hermetic-git gate; first tag v0.6.7). On main, `internal/gitutil/gitignore.go:CheckIgnored` routes through `isolatedGit` (core.hooksPath=/dev/null, core.fsmonitor=false), `internal/core/launch/bundle.go:checkIgnoredStrict` passes the same two pins explicitly with `--no-index` and `gitutil.IsolatedEnv()`, and `internal/gitutil/fsmonitor_exec_test.go:TestCheckIgnoredDoesNotExecuteRepoLocalFsmonitor` passes. The existing resolved record iss-2608270735420161 describes the fix but names no GHSA id and carries no resolved_by stamp; this record binds the advisory to its fixing commit and is not a second defect.
• iss-2609012039118971Observation from the lane LA assessment: the two 0.6.7 security fixes 81f81f67 (GHSA-xrf8-4432-gw2f) and 15a31ea7 (GHSA-h2gm-w3hm-8xpq) were committed without `Resolves:` trailers and their records (iss-2608270735428527, iss-2608270735420161) moved to resolved/ without `resolved_by` stamps, so the RS001-RS003 gates either did not exist or did not fire on the security-release-2026-08-27 integration branch. Worth checking whether the other records from that pass share the gap, and whether the gates run on every integration branch today. Not fixed in this run; the two advisories are bound to their fixing commits by their own ledger markers instead.