fix(release): isolate Git authority

[thequantumfalcon]

What this changes

The release tag helper and its checker previously invoked Git through the
inherited environment: git was resolved from PATH, child processes received
the caller's full environment including GH_TOKEN, and any Git configuration
reachable from the repository or the user's home could name an external helper.
This change gives release Git operations an explicit, isolated profile.

• SSH-only release Git profile. Transport is pinned to SSH with an explicit
  command; no credential helper, no URL rewrite, and no askpass path is
  inherited.
• Sanitized child environments. Git children are launched with a constructed
  environment rather than the caller's, so ambient variables cannot reach them.
• Strict local-config admission. System and global configuration are excluded
  and only an explicit, reviewed set of local settings is admitted, so a planted
  core.fsmonitor, credential helper, signing program, or URL rewrite cannot be
  invoked.
• Absolute trusted executables. Git and its helpers are addressed by absolute
  path; PATH resolution is not used for release operations.
• Bounded execution. Release Git invocations run under explicit bounds rather
  than unbounded inheritance.
• Token-free Git boundary. The GitHub API token is supplied only to the API
  call that needs it and is never present in the environment of any Git child.

This is v0.1.5 trust-closure item R04. There is no linked public issue.

Baseline

Verified against baseline commit 0e654a152a17196609f971feeb36162d3bf15746.

Reproduction

Pre-fix, on the baseline tree with only the new regression file overlaid:

$ python -m pytest -o addopts= -q \
    tests/test_release_controls.py::test_prepare_tag_rejects_an_executable_url_rewrite_before_token_exposure \
    tests/test_release_controls.py::test_release_checker_wrappers_never_resolve_git_through_inherited_path
E       AssertionError: assert not True
E        +  where True = exists()
E        +    where exists = PosixPath('/private/tmp/cce-release-test-tskigg4n/captured-token').exists
3 failed
exit status 1

The synthetic canary was captured through the planted executable path: a
configured URL rewrite ran and wrote the sentinel, proving the token was
reachable by an externally named helper.

Post-fix, the same command on this branch:

3 passed
exit status 0

Local gate results

Run on the exact signed head of this branch:

Gate	Result
just test	2172 passed, 6 skipped
just lint	All checks passed
just deps	causal_continuity_engine/ is stdlib-only
just bench	11/11 scenarios, 6/6 metrics at target
just corpus	reference agrees with all 44 committed vectors
just caps	every claim resolves; no docs/CAPABILITIES.md drift
just build	reproducible distributions; strict exact-byte verification passed; clean before and after

Focused regression: tests/test_release_controls.py and
tests/test_regressions_round8_portability.py, 299 passed.

Checklist

• The PR title is a Conventional Commit — feat, fix, docs, test, refactor, or chore. Given the trust core's change bar, feat usually needs an accepted proposal issue first. Everything is merged by squash, so this title becomes the permanent commit subject on main. See CONTRIBUTING.md.
• just test passes.
• just lint passes.
• just deps passes — causal_continuity_engine/ still imports nothing outside the standard library.
• just bench passes — all eleven ContinuityBench scenarios, every metric at target.
• just corpus passes — the reference still agrees with the committed vectors in vectors/.
• just caps passes — every capability claim still resolves to real symbols, files, and tests. If the claims changed, docs/CAPABILITIES.md was regenerated with python -m causal_continuity_engine.capabilities --write rather than hand-edited.
• just build passes if packaging, generated assets, or release machinery changed — both builds match and the clean-installed wheel audits successfully.
• Every commit carries a Signed-off-by trailer (git commit -s). Enforced: the DCO check is a required status on main, so a pull request with any commit missing the trailer cannot merge.
• No gate was weakened, skipped, or made conditional in order to get a test to pass. If a gate had to change, that change is the subject of this PR and is argued for above.
• No AI attribution anywhere in the diff, commit messages, or PR title or body.

If this is a bug fix

• A regression test pins the defect, and it was verified to FAIL against the pre-fix code. A test that passes both before and after the fix proves nothing.

$ python -m pytest -o addopts= -q tests/test_release_controls.py::test_prepare_tag_rejects_an_executable_url_rewrite_before_token_exposure tests/test_release_controls.py::test_release_checker_wrappers_never_resolve_git_through_inherited_path  # baseline 0e654a15, regression overlaid
3 failed
exit status 1

$ python -m pytest -o addopts= -q tests/test_release_controls.py::test_prepare_tag_rejects_an_executable_url_rewrite_before_token_exposure tests/test_release_controls.py::test_release_checker_wrappers_never_resolve_git_through_inherited_path  # this branch
3 passed
exit status 0