Fix checkpoint bundle dubious-ownership failure under Linux CI (#294 follow-up)

[ealt]

Summary

Follow-up hotfix to #318 (merged as 03614ef). The merged #294 work landed with red compose-smoke-checkpoint / compose-smoke-auto-checkpoint checks (those smoke jobs aren't branch-protection-required yet), so main currently carries the bug: checkpoint export fails with git bundle create ... fatal: Need a repository to create a bundle.

• Root cause (the AGENTS.md uid-match / dubious-ownership trap): the checkpoint repo is a host bind-mount (task-store-repo) whose top directory is owned by the host/runner uid, while the task-store-server runs as eden:1000. Git refuses to recognize a repository owned by a different uid, and git bundle surfaces that rejection as "Need a repository". eden_git.GitRepo already guards every invocation with -c safe.directory={path} (so the integrator's clone of the same host-owned mount works), but eden_checkpoint.repo_bundle's git helper did not.
• Fix: add -c safe.directory=* to repo_bundle._git_env_overrides(), mirroring GitRepo._git_argv. These helpers only ever touch server-managed repos + scratch dirs, so disabling the ownership heuristic carries no untrusted-repo risk.
• Why it slipped past local validation: macOS bind-mounts squash ownership to the container uid, so the dubious-ownership check never triggers locally — the exact "pytest is not a substitute for the bash smoke, and the smoke only fails on Linux" gap. Reproduced + fix-verified in a throwaway Linux container recreating the exact uid mismatch (repo top-dir uid ≠ git process uid): without the flag → "Need a repository"; with it → bundle created.

What this does NOT cover

• No new functional surface — single-line git-config hardening plus a regression guard. The Checkpoint archives carry an empty git bundle under Compose (no --repo-path on task-store-server) #294 deferrals (Helm parity Helm: wire the checkpoint-export repo (--repo-path/--forgejo-url) on the task-store-server #306, smoke object-level depth smoke-checkpoint: deepen post-import equality from counts/id-sets to full-object comparison #312, streaming export Track streaming checkpoint export for very large archives #313) are unchanged and still tracked.
• The ideator-subprocess parallel-load flake (test_ideator_subprocess.py, Flaky: test_loop_respawns_on_subprocess_crash fails with BrokenPipeError under parallel pytest load #307) surfaced again during full-suite validation (test_dispatch_collects_ideas, PermissionError); unrelated to this change (passes in isolation). Tracked in Flaky: test_loop_respawns_on_subprocess_crash fails with BrokenPipeError under parallel pytest load #307.

Fresh-operator walkthrough

• Walkthrough performed against the checkpoint-export flow via both compose smokes (image rebuilt with the fix).
• Notes: bash reference/compose/healthcheck/smoke-checkpoint.sh → PASS (repo.bundle OK: 3256 bytes, 3 variant refs; git bundle verify + ref-set + import round-trip all green); bash reference/compose/healthcheck/smoke-auto-checkpoint.sh → PASS (3 periodic + 1 terminal archive, every one carrying a non-empty bundle). These are the two jobs that were red on main; both green locally with the fix.

Test plan

• Linux-container repro of the exact uid mismatch — confirms failure without the flag, success with it
• bash reference/compose/healthcheck/smoke-checkpoint.sh — PASS
• bash reference/compose/healthcheck/smoke-auto-checkpoint.sh — PASS
• full pre-push gate (complexity, ruff, pyright, docs-lint) — clean
• uv run pytest -q — 2355 passed, 254 skipped (one unrelated Flaky: test_loop_respawns_on_subprocess_crash fails with BrokenPipeError under parallel pytest load #307 flake, passes in isolation)
• new regression guard test_git_env_overrides_disables_dubious_ownership in test_checkpoint_repo_bundle.py

Related issues

• Refs Checkpoint archives carry an empty git bundle under Compose (no --repo-path on task-store-server) #294 — completes the fix merged in Fix #294: checkpoint exports bundle the Forgejo repo of record #318 (the merged version was missing this guard)
• Refs Flaky: test_loop_respawns_on_subprocess_crash fails with BrokenPipeError under parallel pytest load #307 — pre-existing ideator-subprocess parallel-load flake

🤖 Generated with Claude Code