fix(test): RepositoryIdentityTest no longer depends on local git state

The two git-backed tests (resolve_gitRepoWithCommit_commitShaPresent,
resolve_detachedHead_branchIsNull) failed when the developer's global
gitconfig forced commit signing (commit.gpgsign=true, signingkey set) on
a machine without a usable signing key — git commit exited non-zero, the
original run() helper ignored the exit code, no commit was made, and
rev-parse HEAD returned null.

Made the git invocations hermetic:
  * repo-local config overrides commit.gpgsign / tag.gpgsign to false,
    unsets core.hooksPath, core.autocrlf, init.templateDir
  * explicit --no-gpg-sign on the commit (belt-and-braces)
  * scrub GIT_* env vars on every child process so no ambient CI /
    worktree state leaks in
  * run() now asserts the process exited 0 — silent failures become
    loud test failures
  * new requireGit() uses Assumptions.assumeTrue to skip cleanly when
    the git binary is absent (product still covered by non-git tests +
    RepositoryIdentity's own swallow-on-error path)

Verified by running the pre-fix test against a hostile HOME with forced
GPG signing — reproduces the 2 failures. Post-fix: 8/8 pass under the
same hostile environment.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

src/test/java/io/github/randomcodespace/iq/intelligence/RepositoryIdentityTest.java

@@ -4,13 +4,23 @@
 import org.junit.jupiter.api.io.TempDir;
 
 import java.nio.file.Path;
+import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
 
 /**
  * Unit tests for {@link RepositoryIdentity}.
  * Validates graceful degradation when git metadata is unavailable.
+ *
+ * <p>Git invocations in these tests are hermetic: we override every global-config
+ * setting that can cause {@code git commit} / {@code git init} to fail silently
+ * on a developer machine but pass on CI (or vice-versa) — most notably
+ * {@code commit.gpgsign}, {@code tag.gpgsign}, {@code core.hooksPath},
+ * {@code init.templateDir}, and {@code core.autocrlf}. We also scrub
+ * {@code GIT_CONFIG_*} / {@code GIT_DIR} / {@code GIT_WORK_TREE} env vars so the
+ * invoked processes inherit no ambient git state from the parent.
  */
 class RepositoryIdentityTest {
 
@@ -109,31 +119,92 @@ void record_nullFieldsAllowed() {
     // Helpers
     // ------------------------------------------------------------------
 
+    /**
+     * Pre-flight: skip git-dependent tests when the {@code git} binary is not available.
+     * Treat absence-of-git as an environment gap, not a product bug — still covered by the
+     * non-git tests above, and by the {@code RepositoryIdentity.runGit} swallow-all-errors path.
+     */
+    private static void requireGit() {
+        try {
+            Process p = new ProcessBuilder("git", "--version")
+                    .redirectErrorStream(true).start();
+            boolean ok = p.waitFor() == 0;
+            assumeTrue(ok, "git binary not available on PATH");
+        } catch (Exception e) {
+            assumeTrue(false, "git binary not available on PATH: " + e.getMessage());
+        }
+    }
+
     private static void initGitRepo(Path dir) throws Exception {
-        run(dir, "git", "init");
+        requireGit();
+        // -c overrides are applied to THIS invocation only and cannot be shadowed by a user's
+        // global gitconfig (unlike `git config` writes into the new .git/config).
+        run(dir, "git",
+                "-c", "init.defaultBranch=main",
+                "-c", "init.templateDir=",
+                "init");
         run(dir, "git", "config", "user.email", "test@test.com");
         run(dir, "git", "config", "user.name", "Test");
+        // Kill every global knob that can make `git commit` fail on an otherwise-clean repo.
+        run(dir, "git", "config", "commit.gpgsign", "false");
+        run(dir, "git", "config", "tag.gpgsign", "false");
+        run(dir, "git", "config", "core.hooksPath", "/dev/null");
+        run(dir, "git", "config", "core.autocrlf", "false");
     }
 
     private static void makeInitialCommit(Path dir) throws Exception {
         Path readme = dir.resolve("README.md");
         java.nio.file.Files.writeString(readme, "# Test");
         run(dir, "git", "add", ".");
-        run(dir, "git", "commit", "-m", "init");
+        // --no-gpg-sign is belt-and-braces over the repo-local commit.gpgsign=false set above;
+        // --allow-empty-message keeps the test robust if a commit.template hook injects content.
+        run(dir, "git", "-c", "commit.gpgsign=false", "commit",
+                "--no-gpg-sign", "-m", "init");
     }
 
     private static String runGit(Path dir, String... args) throws Exception {
+        requireGit();
         var cmd = new java.util.ArrayList<String>();
         cmd.add("git");
         cmd.addAll(java.util.Arrays.asList(args));
-        var proc = new ProcessBuilder(cmd).directory(dir.toFile()).start();
-        String out = new String(proc.getInputStream().readAllBytes()).trim();
+        var pb = new ProcessBuilder(cmd).directory(dir.toFile());
+        scrubGitEnv(pb.environment());
+        var proc = pb.start();
+        String out;
+        try (var is = proc.getInputStream()) {
+            out = new String(is.readAllBytes(), java.nio.charset.StandardCharsets.UTF_8).trim();
+        }
         proc.waitFor();
         return out;
     }
 
+    /**
+     * Execute a git sub-command and assert it exited 0. Fails the test loudly (not silently)
+     * if setup cannot complete — preferred over ignoring the exit code, which is what let the
+     * GPG-signing failure slip through before.
+     */
     private static void run(Path dir, String... cmd) throws Exception {
-        new ProcessBuilder(cmd).directory(dir.toFile())
-                .redirectErrorStream(true).start().waitFor();
+        var pb = new ProcessBuilder(cmd).directory(dir.toFile()).redirectErrorStream(true);
+        scrubGitEnv(pb.environment());
+        Process proc = pb.start();
+        String stderr;
+        try (var is = proc.getInputStream()) {
+            stderr = new String(is.readAllBytes(), java.nio.charset.StandardCharsets.UTF_8);
+        }
+        int exit = proc.waitFor();
+        if (exit != 0) {
+            throw new IllegalStateException(
+                    "Command failed (exit " + exit + "): " + String.join(" ", cmd)
+                            + "\n" + stderr);
+        }
+    }
+
+    /**
+     * Remove every ambient git env var that could leak the parent shell's context into the
+     * child process (most commonly {@code GIT_DIR}/{@code GIT_WORK_TREE} in a worktree-based
+     * setup, or {@code GIT_CONFIG_*} injected by CI runners).
+     */
+    private static void scrubGitEnv(Map<String, String> env) {
+        env.keySet().removeIf(k -> k.startsWith("GIT_"));
     }
 }