fix: harden windows git and gh cli resolution

[kalvinnchau]

Summary

Fixes SEC-001 by preventing repository-local Hermit binaries from shadowing Berd’s Git and GitHub CLI control executables on Windows.

• Resolve git.exe and gh.exe from the sanitized process PATH before applying repository-local environment activation.
• Use canonical absolute executable paths for Git operations and pull-request lookups.
• Preserve existing Git retry, hook, transport, and captured-environment behavior.
• Add Windows regressions covering malicious .hermit/bin/git.exe and gh.exe sentinels and both production command-construction paths.

Security impact

Previously, opening a repository containing force-added .hermit/bin/git.exe or gh.exe files could cause Berd to execute those binaries when using a captured project environment.

The affected command sinks now retain trusted absolute executable paths, so prepending the repository’s Hermit directory to the child PATH cannot replace the top-level Git or GitHub CLI process.

Validation

• just check
• just tauri-fmt-check
• just tauri-check
• just tauri-test
• just clippy
• just test
• just build
• cargo test --manifest-path src-tauri/Cargo.toml -p berdctl
  • 52 passed; 1 ignored fixture-generator test
• Focused Git tests: 17 passed
• Focused pull-request tests: 2 passed
• Focused directory-environment tests: 11 passed
• Three adversarial review rounds with four reviewers each; final two rounds reported no actionable findings and all ratings were at least 9/10

just ci passed all applicable gates before reaching a macOS-only release test that requires ditto, which is unavailable on the Linux validation host.

[shellz-n-stuff]

LGTM

[morgmart]

🤖 Automated code review

APPROVE. A fresh static review of the exact three-dot comparison 8e7e350...4d02eb9, computed from merge base 3c23443, found no publishable findings, duplicate suppressions, or escalations. Atlas's proposed recovery concern was not retained: excluding repository-local Hermit control executables is the security behavior being fixed, Windows onboarding already establishes globally discoverable Git, and optional PR enrichment preserves its existing fallback contract. Spar's proposed broader trust-boundary concern was not retained because this PR is specifically scoped to preventing Berd's reconstructed Hermit PATH from replacing control executables; repository PATH contamination through unrelated activation mechanisms is not established as caused by this comparison, and the changed API is named for control-executable resolution rather than a general executable trust guarantee. Vogue classified the five changed src-tauri Rust files as backend-only with no changed graphical desktop surface. Engineering applied code-review and wes-review and found the executable-selection sequencing, fallback behavior, and discriminating tests sound. Final self-check covered Git operations, hooks and project tools, PR-summary enrichment, missing executables, Windows PATH sanitization and canonicalization, Unix compatibility, accessibility, localization, navigation and consent, async/error/never-completes/lifecycle/race behavior, test honesty, project laws, design-system rules, duplicate overlap, and the evidence and user-effect threshold for blocking severity. The supplied GitHub evidence was inspected and is structurally valid: ten checks completed successfully and one completed as skipped at the requested head; required checks still govern merge readiness. No local code, tests, builds, package managers, generated binaries, hooks, or project scripts were run.

Deterministic publication result: 0 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.