Harden branch adjudication Git evidence

[andrei-hasna]

Summary

• Fixes the P1 inherited GIT_* authority bypass in branch-adjudication Git evidence checks.
• Scrubs inherited GIT_* case-insensitively and enforces explicit no-fetch, no-replace, and no-protocol controls.
• Adds five regressions covering GIT_DIR/GIT_WORK_TREE, object directory, alternate objects, replacement objects, and injected lazy fetch.

Verification

• RED: 9 pass / 5 fail.
• GREEN: focused 14/14; related superset 146/146; full 357/357; typecheck and build.
• Manifests and lockfiles unchanged.
• Two independent exact-commit reviews.
• Staged and exact committed-range gitleaks: zero leaks.

Scope

No live DB, apply, install, or publish.