Closes #74.

Problem

Under the full concurrent test run, integration/protocol tests run git in scratch/temp dirs. When a setup step races or fails under load, a mutating git command escapes via git’s upward repository discovery, finds this project’s real .git, and silently corrupts the developer’s checkout — rewrites origin to a dead test server, force-updates origin/main to scratch commits, sets core.bare=true, and leaves stray commits.

Deterministically reproduced from a scratch dir under the repo:

( cd tmp/x/not-a-repo && git config core.bare true )   # sets core.bare on the PROJECT repo

Fix

Set GIT_CEILING_DIRECTORIES to the project root in test/test_helper.exs, so git’s upward search stops before the project root; a stray command now fails not in a git directory in place instead of mutating the checkout. Adds a regression test asserting the guard is set and that git cannot discover the project repo from a scratch dir.

Verification

• New regression test passes; the mutating command leaves the repo’s core.bare unchanged.
• Full integration suite still 81/0 with the guard (it’s a no-op for tests that use real temp repos).

Not in scope

The guard contains the corruption but does not fix the underlying load-flakiness of the protocol/HTTP tests (port/timeout races). Tracked separately.