fix(coverage): restore LLVM 19 tools on current main

[seonghobae]

Purpose

Restore the protected-current-main OpenCode Rust coverage toolchain after DiskSage PR #133 exact head b7f980d265713d5ffb84f744ce454589e3d410ea exposed the central failure failed to find llvm-tools-preview in run 31037491215, job 92413313900.

Test-first history

• RED c8bbf698f46d6ac8ffc75e341b756feb4a1b882e: adds a permanent ordering contract requiring LLVM 19, both explicit tool paths, and executable validation before cargo-llvm-cov installation.
• GREEN 3994d313d0fa71f17bd12c4f522bbc65a2d55f11: restores the trusted toolchain configuration and records doctoring/changelog evidence.
• Security RED 748bc5d5d733ddea93b592bd4091ea5a8005d55c: requires all three low-privilege coverage wrappers to disable ambient system/global Git configuration before applying the bounded safe-directory overlay.
• Current exact head 8323b7855dae96c8613f4f192b907f5c05bf6553: transient branch-writer experiments were removed; the PR remains draft because the security RED contract correctly fails until the six Git-isolation lines are restored.

Current exact-head evidence

At 8323b7855dae96c8613f4f192b907f5c05bf6553, Scorecard, Secret Scan, SBOM Generation, Security Scan, OSV-Scanner, SAST Semgrep, CodeQL, and Python Security pass. These successful checks do not supersede the failing focused Git-isolation contract or constitute approval evidence.

Required repair

Restore GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null before GIT_CONFIG_COUNT=1 in run_and_capture, run_r_package_testthat, and run_and_capture_advisory; preserve the LLVM 19 package and explicit tool bindings; update doctoring and CHANGELOG wording; and rerun the focused exact-head contract plus all repository gates.

Merge gate

Keep Draft until the final diff is verified against current protected main, every current-head CI/security/review gate passes, no actionable thread remains, and a qualifying independent non-author approval and branch protection permit merge without bypass. After merge, start a fresh DiskSage #133 OpenCode review on its unchanged exact current head; do not reuse the failed predecessor run or any older-head evidence.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: aa9b8adf-a688-4ed2-af6e-01f5e1dd8688

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head scope review found an unrelated security regression in the final diff. The PR says it is limited to restoring the four LLVM-toolchain lines, its contract test, doctoring, and changelog, but .github/workflows/opencode-review-dispatch.yml also removes GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null from three privileged container invocations. Restore all six Git-configuration-isolation lines before marking Ready. Add a permanent regression proving every affected invocation retains both variables, preserve the LLVM 19 fix, rerun exact-head quality/security checks, and keep this PR Draft until the repaired head is reviewed.

[seonghobae]

@opencode-agent address

Address only the verified scope regression above: restore GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null in all three affected invocations, add the ordering/presence regression beside the LLVM contract, preserve the LLVM 19 changes, and run the exact-head focused and security gates. Do not alter reviewer credentials, model routing, workflow permissions, or unrelated files.

[seonghobae]

Current-head review found one valid security regression that must be fixed before this draft can become ready.

The LLVM 19 repair is directionally correct, but the same workflow diff removes GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null from all three low-privilege coverage execution wrappers (run_and_capture, run_r_package_testthat, and run_and_capture_advisory). Protected base f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae includes both variables in each wrapper. Their removal re-enables ambient system/global Git configuration inside PR-controlled test processes and is unrelated to the LLVM toolchain fix.

Please repair test-first on the exact current branch:

1. Add a permanent contract test that enumerates the three sandbox wrappers and requires both Git-isolation variables before GIT_CONFIG_COUNT=1.
2. Restore both variables in all three wrappers without changing the LLVM 19 additions.
3. Re-run the exact-head quality/security workflows and keep the PR in draft until all current-head reviews and independent approval are satisfied.

Do not resolve this finding using coverage exclusions, weaker checks, or by removing the safe-directory-only Git configuration.

[seonghobae]

@opencode-agent address

Re-evaluate exact current head 8323b7855dae96c8613f4f192b907f5c05bf6553. Fix only the verified security regression already covered by the failing contract: restore GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null before GIT_CONFIG_COUNT=1 in run_and_capture, run_r_package_testthat, and run_and_capture_advisory; preserve the LLVM 19 package/tool bindings; update the existing doctoring and CHANGELOG wording to record preserved ambient-Git isolation; run the focused exact-head contract and repository security/quality gates; and do not add any branch-writer, one-shot repair workflow, credential change, permission expansion, model-routing change, or unrelated file modification.