fix(targets): resolve Git metadata outside its config

[mldangelo-oai]

Summary

Git 2.55 can load malformed configuration when policy discovery resolves a saved Git metadata directory from inside that directory. Run the resolver from its parent so metadata stays excluded and ordinary policy files remain visible.

Changes

• Give the private Git helper a working-directory override while retaining the original repository for executable trust checks.
• Extend the existing metadata tests to cover a valid enclosing checkout, visible policy files, and unchanged configuration bytes.

Testing

• The extended regression fails twice on the parent with Git 2.55 and passes all four cases with this change on Git 2.43 and 2.55.
• Two full Linux SDK runs: each 3,068 passed, 50 skipped, zero failed. The complete tracked test source matched this commit; the test checkout retained the parent HEAD.
• Fresh-install macOS target and policy tests on Git 2.54 and 2.55: each 80 passed, two Windows-only skips.
• Five portable source checks, SDK types and formatting passed. Three native source reviews and independent verification found no actionable issues; their missing-dependency runtime limits are separate from the successful test runs above.

Initial setup and formatting failures were corrected before the reported passing runs. Latest CI passed on this commit, as did an earlier complete run. An intervening run and its single-job retry timed out during Windows npm installation, before package assertions. Those original failures remain recorded; no timeout or assertion was changed.

Risk and rollout

This restores metadata detection without changing public commands, defaults, or output. Only the metadata resolver uses the new working directory. The original executable trust context and other Git call sites retain their existing behavior.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head, 5c08e4b4318825b062249f521c235be4cc4ba9f1.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T08:29:23.371242Z	5c08e4b	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-16T08:30:50.046478Z	5c08e4b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 5c08e4b431

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".