Make the cmd-package git tests hermetic: strip the harness GIT_* env from spawned git #299

At the trigger commit's tree (head 01673ac = main 4ee0a77 + 212 insertions; cmd/ package, module github.com/vulnetix/cli/v4), the go suite's only failing package is ./cmd: 16 tests FAIL, the rest of the 103-package suite is green.

Failing tests (all in cmd/, go test -count=1 -timeout 300s ./cmd/ -run 'TestBlameSecrets|TestGitDescribeVersion|TestGitCommitDate|TestResolveTeaReleaseInputs'):

• TestBlameSecrets, TestBlameSecretsReadsHistoryCopies (cmd/code_enrich_test.go:72, 141)
• TestGitDescribeVersion_TaggedRepo, OnTheTag, NoTags (cmd/tea_release_test.go:48, 65, 80)
• TestGitCommitDate_MatchesHeadCommitterDate, DeterministicAcrossCalls, NormalisesNonUTCOffset, StableWhenHeadMovesPastTheTag, FallsBackWhenTagIsUnknown (tea_release_test.go:97, 122, 143, ...)
• TestResolveTeaReleaseInputs_ExplicitVersionWinsOverAutoVersion, TagRunIsNotPreRelease, BranchRunIsPreRelease, WithoutAutoVersionBranchStillErrors, ExplicitDateWinsOverCommitDate, DateDefaultsToCommitDateAndIsStable (tea_release_test.go:165, 192, 217, 241, 254, ...)

Failure signature (identical for all 16, e.g. cmd/tea_release_test.go:49 and cmd/code_enrich_test.go:146):
git init -q -b main: exit status 128
error: could not lock config file /workspace/worktrees/cli-c362bc3c/K-f79343-40e9a6.belai-git/common/config: Read-only file system
fatal: could not set 'core.repositoryformatversion' to '0'

Root cause: the tests spawn git via exec.Command (cmd/tea_release_test.go initGitRepo, line 18; cmd/code_enrich_test.go gitIn, line 61). The runner exports harness GIT_DIR/GIT_OBJECT_DIRECTORY/GIT_CONFIG_COUNT/GIT_CONFIG_KEY_0/GIT_CONFIG_KEY_1/GIT_CONFIG_VALUE_0/GIT_CONFIG_VALUE_1 pointing into the read-only .belai-git/admin dir, so every spawned git init fails on the read-only shared config. This is a hermeticity gap in the tests, not a product regression: the same git-using helper in internal/gitctx was fixed exactly this way (see commits 7343d01bc/3b8d010ff/46617eefd on branch belai/K-22f91b/a1 and the K-287186 quality card). Evidence the product code is unaffected: the full cmd suite passes when the harness GIT_* vars are stripped and GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null GIT_CONFIG_NOSYSTEM=1 are set (run on this same tree: env -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_INDEX_FILE -u GIT_CONFIG_COUNT -u GIT_CONFIG_KEY_0 -u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_0 -u GIT_CONFIG_VALUE_1 GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null GIT_CONFIG_NOSYSTEM=1 go test -count=1 -timeout 540s ./cmd/ → ok, 134s).

Change to make (test-only, in cmd/): make initGitRepo (tea_release_test.go:18-44) and gitIn (code_enrich_test.go:61-67) build the child git process env by clearing the harness-set vars (GIT_DIR, GIT_WORK_TREE, GIT_COMMON_DIR, GIT_OBJECT_DIRECTORY, GIT_ALTERNATE_OBJECT_DIRECTORIES, GIT_INDEX_FILE, GIT_CONFIG_COUNT, GIT_CONFIG_KEY_, GIT_CONFIG_VALUE_) and setting GIT_CONFIG_NOSYSTEM=1 plus GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_SYSTEM=/dev/null. Copy the exact helper approach used in internal/gitctx tests (branch belai/K-22f91b/a1, commits 3b8d010ff/46617eefd) and the cmd K-287186 handoff, which the delivery crew notes (.vulnetix/crews/delivery.md "K-287186") already document as the working recipe. Do not weaken the assertions and do not touch production code; this is a hermeticity fix to the test helpers. Prior art on the board: K-04f06b (review) fixes initGitRepo's bare git tag editor prompt, a separate initGitRepo issue; do not duplicate it.

Acceptance gates:

• The 16 tests pass under the harness environment: go suite, dir cmd, each named test (narrowed suite must be green with all 16 passing). The harness runs the detected suites; under the harness env all 16 must pass without env scrubbing.
• The rest of ./cmd keeps passing (go suite, dir cmd): no assertion weakened, no regression.
• Full go suite green: go test ./... passes in the harness environment (the git-env failures are the only known suite failure at this head; the advisories tests K-3e

_{Synced from Belai card K-fcb32f on Vulnetix. Edit here or on the board; both update.}