fix untrusted-workspace RCE in dugite git resolution (T-98)

Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).

Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).

Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.

Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/kernel/src/backend_entry.dart

@@ -45,11 +45,10 @@ void backendEntry(BackendBootMessage boot) {
   late Toolchain toolchain;
 
   // Phase 1: resolve toolchain — just find binaries, don't init services.
-  // We need a project root for dugite paths. Use a sensible default;
-  // the real project comes from project.open.
-  final resolveRoot = boot.hintRoot ?? Platform.environment['HOME'] ?? '/tmp';
+  // Dugite is resolved against the install dir; per T-98 the project
+  // root is never inspected during toolchain resolution.
   toolchain = Toolchain();
-  toolchain.applyResolved(resolveToolchainPaths(resolveRoot));
+  toolchain.applyResolved(resolveToolchainPaths());
 
   // Listen for messages from the frontend.
   requestPort.listen((message) async {
@@ -77,10 +76,10 @@ void backendEntry(BackendBootMessage boot) {
       final projectPath = message['path'] as String;
       final workDir = Directory(projectPath);
 
-      // Re-resolve toolchain with the actual project root (finds
-      // dugite in native/dugite/, etc.)
+      // Re-resolve toolchain. Project path is not inspected (T-98);
+      // dugite still comes from the install dir + env override.
       toolchain = Toolchain();
-      toolchain.applyResolved(resolveToolchainPaths(projectPath));
+      toolchain.applyResolved(resolveToolchainPaths());
 
       // Clear existing handlers and re-register with new project.
       dispatcher.clear();

lib/kernel/src/toolchain.dart

@@ -78,6 +78,6 @@ class Toolchain extends ChangeNotifier implements ToolchainView {
 
   /// Pure function — runs in a background isolate. All file I/O happens
   /// here, off the main thread. Delegates to the Flutter-free
-  /// [resolveToolchainPaths].
-  static ResolvedPaths resolvePaths({required String workspaceRoot}) => resolveToolchainPaths(workspaceRoot);
+  /// [resolveToolchainPaths]. Takes no workspace argument: see T-98.
+  static ResolvedPaths resolvePaths() => resolveToolchainPaths();
 }

lib/kernel/src/toolchain_paths.dart

@@ -73,14 +73,18 @@ class _StaticToolchain implements ToolchainView {
       ];
 }
 
-/// Top-level function for compute/isolate use. Takes a single String
-/// argument (the workspace root) and returns a plain-data result.
-ResolvedPaths resolveToolchainPaths(String workspaceRoot) {
-  final dugite = '$workspaceRoot/native/dugite/bin';
-
+/// Top-level function for compute/isolate use. Returns a plain-data
+/// result with all tool paths resolved against trusted locations only.
+///
+/// Critically does NOT take a workspace path: per T-98, resolving the
+/// dugite-bundled git against the open workspace was a code-execution
+/// vector (a malicious repo could plant `native/dugite/bin/git`).
+/// Dugite is resolved against the install directory + an explicit env
+/// override; everything else comes from PATH.
+ResolvedPaths resolveToolchainPaths() {
   String? git;
   Map<String, String>? gitEnv;
-  final dugiteGit = _firstExisting(['$dugite/git']);
+  final dugiteGit = _resolveDugiteGit();
   if (dugiteGit != null) {
     git = dugiteGit;
     final dugiteRoot = File(dugiteGit).parent.parent.path;
@@ -101,6 +105,29 @@ ResolvedPaths resolveToolchainPaths(String workspaceRoot) {
   );
 }
 
+/// Locate the dugite-bundled git binary in trusted install locations
+/// only. **Never inspects workspace-relative paths** — see T-98.
+///
+/// Search order:
+///   1. `CLIDE_DUGITE_DIR` env var (dev override; points at a dugite
+///      root that contains `bin/git`).
+///   2. `<exe-parent>/dugite/bin/git` — production bundle layout.
+///   3. `<exe-parent>/lib/dugite/bin/git` — alternate bundle layout
+///      (mirrors Linux's INSTALL_BUNDLE_LIB_DIR convention).
+///
+/// Returns null if no dugite is found; caller falls back to PATH git.
+String? _resolveDugiteGit() {
+  final candidates = <String>[];
+  final envDir = Platform.environment['CLIDE_DUGITE_DIR'];
+  if (envDir != null && envDir.isNotEmpty) {
+    candidates.add('$envDir/bin/git');
+  }
+  final exeDir = File(Platform.resolvedExecutable).parent.path;
+  candidates.add('$exeDir/dugite/bin/git');
+  candidates.add('$exeDir/lib/dugite/bin/git');
+  return _firstExisting(candidates);
+}
+
 String? _findOnPath(String name) {
   for (final dir in _expandedPath().split(':')) {
     if (dir.isEmpty) continue;