Linux desktop app crashes with SIGILL when a conversation is bound to a git repository

Versions affected: 26.825.41651 and 26.825.51511, official Linux deb, x86_64. Reproduced on three consecutive builds.

Environment: NixOS unstable. The package wraps the official deb with autoPatchelf; system git is on PATH. The crash is in app JS, not the wrapper.

Repro (two steps, no interaction beyond selection):

1. New conversation, then Choose Project.
2. Select any real git working repository (tested with repos of 400 to 1200 commits, 5 to 8 MB .git).

The app dies instantly, before any message is sent. Opening an existing thread whose working directory is a git repo triggers the same crash. Conversations in non-git directories and cloud threads are unaffected.

Signature: The crash is in the background git worker thread (thread name git in coredumps). V8 fatal calls node::GetNodeReport, then the ud1 trap kills the process (SIGILL, si_code ILL_ILLOPN). The stack is exhausted at the moment of the fatal, so no error message ever reaches stderr or any log. Request-level tracing of the worker shows the last handled operations are subscribe-live-query for current-branch on the repo root, then current-branch, then death. Consistent with runaway synchronous recursion in the live-query watcher setup path.

Ruled out:

• V8 heap OOM: an 8 GB heap cap changes nothing; the repro repos are small.
• Unhandled promise rejections: explicit catch around the fire-and-forget subscribe-live-query dispatch plus process.on('unhandledRejection') handlers never fired. The fault is synchronous.
• Contention with other codex processes: crash persists with every other codex app-server on the host stopped.
• Thread or rollout format skew: crashes with no thread involved at all, only a repo selection.
• Local app state: identical crash with a fully wiped Chromium profile and again with an isolated, fresh CODEX_HOME containing no CLI threads and no shared state.

Evidence available on request: 20+ coredumps across builds, the request-level trace of the terminal sequence, and per-build reproduction logs.

Reproduce on the Linux desktop app by selecting a real git repository, then inspect the background git worker around the subscribe-live-query operations for current-branch. Use the available coredumps and request-level trace to confirm the recursion or stack exhaustion path; done means repository-bound conversations no longer crash while non-git and existing-thread cases remain functional.