git exports GIT_DIR and GIT_INDEX_FILE to hooks. The pre-commit pytest
step inherited them, and tests/dev/test_gen_config_deploy.py's scratch
repos (git init --bare / clone / commit / push in tmp dirs) therefore
ran against the repository being committed to: on 2026-10-27 a commit
that staged infra files left its branch on nine "base / docs only / mc
config" commits by author `t`, swapped the index for the fixture's
tree, and wrote uploadpack.allowAnySHA1InWant into the .git/config that
every worktree shares. It only stopped there because `git push origin`
found no `origin` remote.
- sem.hooks: the pytest step gets the hook env minus GIT_DIR,
GIT_INDEX_FILE, GIT_WORK_TREE, GIT_PREFIX, GIT_COMMON_DIR and the
object-dir variables.
- test_gen_config_deploy: its git helper and detector runner drop all
GIT_* from os.environ, so any wrapper that exports them is safe too.
- Regression test: a nested `git init` under a hook-style GIT_DIR lands
in its own directory.
Refs #1365
1e2865acbd