[rmcdaniel]

Follow-ups from the General interim review of #178 (cleared at 675236e). This is stacked on #178's branch so the diff shows only these two changes. It retargets to main once #178 merges, and won't merge before #178.

Changes

1. Inline entry into the tagged tree. test_tagged_tree_working_directory_runs_only_maintained_entrypoints already pins every working-directory: release-source step to an allowlisted command. It now also fails any step without a working directory whose run: enters the tree with cd or pushd (ENTERS_TAGGED_TREE), for example cd release-source && …, pushd ./release-source or cd "$GITHUB_WORKSPACE/release-source". git -C release-source …, which the workflow uses to read the tag commit, stays allowed. A separate test pins the detector's positive and negative cases.
2. unset PYTHONPATH in install-release-tooling.sh. -I protects the interpreters the script starts, but pip --python <venv>/bin/python runs the target interpreter as a child, and that child would still read PYTHONPATH. The installer trust test now sets a hostile PYTHONPATH, and its stub interpreter refuses if the variable reaches it.

Evidence

Targeted tests in a bounded rust:1.86.0-bookworm container (Python 3.11): the 5 affected tests pass.

Counterfactuals on a scratch clone:

• Changing the gate job's "Resolve exact release identity" step to cd release-source && head_commit=… fails the allowlist test with the matched command.
• Removing unset PYTHONPATH fails the installer test with "PYTHONPATH reached the release tooling interpreter".

The full test-publish-rust-sdk.py needs the hash-locked release tooling (markdown_it and others) that CI installs, so hosted CI is the authority for the complete suite.

🤖 Generated with Claude Code