test: drain the fixture-git-isolation grandfathered baseline

[kyle-sexton]

Closes #2872

Summary

Drain the 33 remaining grandfathered fixture-building suites so every suite that builds a git fixture clears the inherited git environment, including GIT_CONFIG. The baseline file is deleted because the gate treats a missing file as empty.

Fix

Add the CREDIT-required clear near the top of each remaining suite:

unset GIT_DIR GIT_WORK_TREE GIT_CONFIG

That matches the current gate (NREQ is 3 after #3086). Suites that already source an isolating harness were not in this list. scripts/fixture-git-isolation-baseline.txt is deleted — the gate already allows a missing baseline (if [[ -f "$BASELINE" ]]). The CI job comment no longer claims grandfathered debt.

Touched plugins take a patch bump (published-version reuse): actionlint 0.8.17, bash-format 0.7.19, biome-format 0.6.18, claude-config 0.38.9, claude-ops 0.35.3, code-tidying 0.13.2, desktop-notification 0.6.16, docs-hygiene 0.18.3, eol-normalizer 0.6.17, go-format 0.3.19, guardrails 0.29.6, markdown-format 0.11.25, mcp-tools 0.3.1, powershell-format 0.7.18, repo-fleet-hygiene 0.23.8, review 0.26.5, ruff-format 0.6.19, source-control 0.54.16, testing 0.7.3, typos-format 0.6.22, work-items 0.39.12.

No gate logic change.

Verification

From /tmp/wt-2872 on cursor/2872-fixture-baseline-drain-cfcf:

• scripts/check-fixture-git-isolation.sh --check — fixture git isolation: OK (87 isolated, 0 baselined)
• scripts/check-fixture-git-isolation.sh --list — 87 isolated, 0 baselined, 0 violating
• bash scripts/check-fixture-git-isolation.test.sh — ALL PASS (live corpus included)
• bash scripts/test-git-helpers.test.sh — pass
• scripts/check-changelog-parity.sh --check / --check-order / --check-bump origin/main / --check-preserved origin/main — pass
• The 33 drained suites ran locally: 31 pass (2 skip for missing gofmt/pwsh). Two suites fail the same way on origin/main in this environment (ruff-format path-relativity vs current Ruff output; claude-observability when CLAUDE_PROJECT_DIR points at another checkout). Unsetting CLAUDE_PROJECT_DIR makes observability 33/33 on both this branch and main.

Related

• Refs test-fixture isolation: git -C does not survive an exported GIT_DIR #2840 (the gate and the leak)
• Refs Widen the fixture-isolation credit signal to require GIT_CONFIG #2889 / Refs Extend the fixture-isolation gate's logical-line join to the shell arm, and credit two correct clear idioms it rejects #2893 / Refs fix: require GIT_CONFIG for fixture-isolation credit and join shell continuations #3086 (CREDIT now requires GIT_CONFIG; this PR only drains)

[claude]

Claude finished @kyle-sexton's task in 1m 42s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Skip-gate check
• Review changed files for security-relevant issues
• Post findings

No security issues found.

This PR is a mechanical hardening change: it adds unset GIT_DIR GIT_WORK_TREE GIT_CONFIG near the top of the 33 fixture-building test suites that were previously grandfathered as debt in scripts/fixture-git-isolation-baseline.txt, then deletes that baseline file. I cross-checked the deleted baseline's 33 entries against the 33 changed test files and confirmed they match exactly — no previously-exempted suite was left un-isolated, and scripts/check-fixture-git-isolation.sh already treats a missing baseline file as empty (if [[ -f "$BASELINE" ]], line 455), so the deletion doesn't weaken the gate.

Notes:

• The unset is consistently placed before any fixture-building git init/mktemp -d work in every touched file — no ordering gap that would let a leak slip through in any individual suite.
• This directly closes the class of issue behind test-fixture isolation: git -C does not survive an exported GIT_DIR #2840: an inherited GIT_DIR/GIT_WORK_TREE/GIT_CONFIG previously let a fixture-building test redirect git init/git config into the caller's real repo config, which is a genuine (if CI-local) integrity risk. Adding GIT_CONFIG to the existing git_env_reset in plugins/review/skills/fanout/scripts/diff-vs-base.test.sh closes the same gap there.
• .github/workflows/ci.yml change is comment-only (no permissions:, trigger, or step logic change) — updates the job comment to reflect the drained baseline.
• No injection surfaces, credential/token handling, or GitHub Actions permission/trigger changes in this diff.

[github-actions]

Last security-reviewed head: d927d53baf28b7a36758f17a9076e45540e7bc43. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @cursor[bot]'s task in 3m 7s —— View job

---

Code review: /review:code-review

• Gather context (PR diff, CLAUDE.md, review skill instructions)
• Run /review:code-review criteria against changed files
• Post inline findings (none — see below)
• Final summary

Summary

Verified the drain against origin/main's prior baseline
(scripts/fixture-git-isolation-baseline.txt) — all 33 grandfathered
entries got the unset GIT_DIR GIT_WORK_TREE GIT_CONFIG line, placed before any
fixture-building git call in every file, matching NREQ = 3 in
check-fixture-git-isolation.sh#L152.
The baseline deletion is safe: the gate guards the file read with
if [[ -f "$BASELINE" ]] (check-fixture-git-isolation.sh#L455), so a missing
file degrades to zero baselined entries rather than erroring.

Two files got more than the mechanical one-liner, both correctly:

• plugins/review/skills/fanout/scripts/diff-vs-base.test.sh already had its
  own inline git_env_reset() helper (not a sourced harness), so it needed
  both the top-of-file unset and GIT_CONFIG added to that helper — both
  landed.
• plugins/repo-fleet-hygiene/skills/apply/scripts/apply-plan.test.sh places
  the unset before set -euo pipefail rather than after (every other file
  puts it after set -uo pipefail); functionally equivalent since unset
  doesn't fail under -e, not a real inconsistency.

The .github/workflows/ci.yml comment update accurately reflects the drain
(no gate logic changed — confirmed the diff only touches the comment lines).
20 plugin .claude-plugin/plugin.json files got a matching patch version
bump with a corresponding CHANGELOG.md entry; spot-checked several
(actionlint 0.8.16→0.8.17, claude-ops 0.35.2→0.35.3, source-control
0.54.15→0.54.16) and all versions/changelog headers agree.

One pre-existing, out-of-scope issue noted for awareness only (untouched by
this PR, not filed as a blocking finding): scripts/check-stale-base-overlap.test.sh
still has the top-level cd "$repo" calls (lines 45/59/77/95) that the old
baseline comment flagged as "structurally fragile ... wants its own change" —
that's a separate concern from the GIT_CONFIG isolation this PR addresses,
and the PR description doesn't claim to fix it.

No inline comments posted — I found no high-signal correctness or
maintainability issues introduced by this change. It is a well-scoped,
mechanical drain that matches its own stated verification.

Note: test execution and --check/--list output in the PR description are
author-claimed and not independently re-run by me in this review pass; I
verified the change statically against the gate's script logic and the prior
baseline file instead.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.