Make test git isolation structural: runGit helper + forbidigo rule

#2171 isolated the 38 git invocations in cmd/entire/cli/strategy/hooks_test.go by assigning cmd.Env = testutil.GitIsolatedEnv() at each call site. That closed the leak in that file, but by repetition - nothing prevents the 39th call site from omitting it, which is the exact failure #2171 was repairing.

Sixteen sibling sites remain unisolated:

• cmd/entire/cli/review/scope_test.go (6)
• cmd/entire/cli/gitrepo/gitstatus_guard_test.go (3)
• cmd/entire/cli/strategy/commit_hook_perf_test.go (3, behind //go:build hookperf)
• singles in review_context_test.go, integration_test/resume_test.go, checkpoint/redact_cache_scope_test.go, checkpoint/remote/git_test.go

Without isolation these read the developer's global gitconfig. #2171 demonstrated the consequence: with init.defaultBranch=feature set globally, four tests in hooks_test.go failed with an opaque failed to create worktree: exit status 255.

Suggested: a file-local or package-level runGit(t, dir, args...) helper that bundles the Env assignment and the repeated error check, then a forbidigo rule for bare exec.Command(..., "git", ...) in _test.go files - the same mechanism already used to keep callers off worktree.Status().