fix/batches: prevent Git commondir config bypass

[cbrnrd]

Problem

A batch container can create a .git/commondir file that points Git to an attacker-controlled directory. The existing metadata restoration only restores .git/config and .git/config.worktree, so host-side Git commands can still read malicious configuration from the redirected directory. A malicious clean filter can then run code on the host outside the container.

This fixes VULN-153.

Solution

Snapshot .git/commondir with the other trusted Git control files and restore it before every host-side Git command. If the original repository did not have a commondir file, an injected file is removed before Git runs.

The regression test creates an attacker-controlled common directory with a malicious clean filter and verifies that diff generation uses the trusted Git configuration instead.

Verification Evidence

• go test ./internal/batches/workspace -count=1
• go test ./internal/batches/...
• git diff --check

[cbrnrd]

Merge activity

• Sep 9, 1:26 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Sep 9, 1:27 PM UTC: Graphite rebased this pull request as part of a merge.
• Sep 9, 1:33 PM UTC: @cbrnrd merged this pull request with Graphite.