fix(corpus): --require-consensus, git floor, scoped GIT_SSH_COMMAND (DSE-1528)

[ernestprovo23]

Closes the Low/Info residuals from the CSO re-verification of PR #100 (DSE-1515 phase 1) — DSE-1528.

What changed

Finding	Fix	Test
N2 evidence suppression → NOVEL exit 0	--require-consensus: WRD-CONSENSUS-NOVEL / -INSUFFICIENT become high + exit 1; limitation stated plainly in docs/COMMUNITY_CORPUS.md §2 with --corpus-ref pinning as the other half of the control	test_require_consensus_makes_novel_and_insufficient_blocking, test_run_consensus_threads_require_consensus, test_require_consensus_blocks_novel_and_insufficient (CLI, JSONL + SARIF error level), stray-flag parametrize
N3 no git version floor	git --version parsed once per process; < 2.14.1 → UNREACHABLE before any clone; ssh:// kept	test_git_version_floor (5 cases), test_unparseable_git_version_is_unreachable, test_missing_git_is_unreachable
N4 GIT_SSH_COMMAND/PATH forwarded	git resolved to an absolute path once (shutil.which → resolve()); GIT_SSH_COMMAND forwarded only to the clone of an ssh:///git@ source, never for https, never to checkout/rev-parse	test_git_argv_is_hardened_and_source_is_last (asserts absolute binary + no GIT_SSH_COMMAND on https), test_git_ssh_command_is_forwarded_only_for_ssh_sources
N5 docstring	corpus_verify.py now says the statement is built from the coordinate that determines the directory	—
N6 non-injective coordinate→directory	documented in §4 as fail-closed (@org/name vs @org__name)	—
N7 redundant bounded read	_check_bounded (stat only) replaces the read-then-discard; read_lock reads once	existing test_size_caps

Acceptance criteria

• --require-consensus implemented, documented, tested (NOVEL/INSUFFICIENT → exit 1 under the flag)
• docs/COMMUNITY_CORPUS.md §2 states the evidence-suppression limitation plainly
• git version floor enforced with a test (ssh:// retained)
• git resolved to an absolute path; GIT_SSH_COMMAND forwarded only for ssh sources; env-subset test updated
• N5 docstring corrected; N6 documented; N7 redundant read removed
• Full suite + ruff green

Security review (CSO GREEN) — fold-ins before merge

Finding	Fix	Test
L1 ~/.gitconfig credential.helper / core.askPass is a program git execs on an https clone	-c credential.helper= and -c core.askPass= added to _GIT_CONFIG (every git argv)	test_git_argv_is_hardened_and_source_is_last asserts both
L3 --require-consensus with a local --corpus and no --corpus-ref only half-closes the evidence-suppression gap	one stderr warning naming the unpinned tree and the --corpus-ref fix	test_require_consensus_blocks_novel_and_insufficient (warns) + test_require_consensus_unpinned_warning_is_silent_when_ref_is_pinned
nit	blank line before ### Fixed in CHANGELOG	—

Branch was merged with origin/main (post-#103) before the fold-in. Full suite after fold-in: 1116 passed, 2 skipped, 88.08%; ruff check . clean; corpus tests 105/105.

Verification (dse-builder-01, py3.12)

• pytest tests/test_corpus.py tests/test_corpus_cli.py: 104 passed
• Full suite w/ coverage (COVERAGE_PROCESS_START): 1105 passed, 2 skipped, 88.10% (floor 80)
• ruff check . clean

Also in this PR: docs/COMMUNITY_CORPUS.md §8 no longer says phase 2 is pending — it links the live mcp-warden-locks corpus (the text was stale after DSE-1515 phase 2 shipped).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Lu4ZLyWWL7TXMGYpNFU5Dc