fix(tests): scratch-repo fixtures never invoke the operator's gpg

The evidence/review-log/hook fixtures inherited global commit.gpgsign, so
fixture commits called the operator's gpg-agent — which fails with "Cannot
allocate memory" under parallel shard load, breaking test SETUP (not the code
under test). All fixture git invocations now pass -c commit.gpgsign=false
-c tag.gpgsign=false. Hermetic repos, no pinentry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/evidence.test.ts

@@ -11,7 +11,7 @@ let gstackHome: string;
 let repoDir: string;
 
 function git(args: string) {
-  execSync(`git -c user.email=t@test -c user.name=t ${args}`, { cwd: repoDir, encoding: 'utf-8', timeout: 10000 });
+  execSync(`git -c user.email=t@test -c user.name=t -c commit.gpgsign=false -c tag.gpgsign=false ${args}`, { cwd: repoDir, encoding: 'utf-8', timeout: 10000 });
 }
 
 function run(args: string[], opts: { cwd?: string } = {}): { status: number; stdout: string; stderr: string } {

test/hook-scripts.test.ts

@@ -31,7 +31,7 @@ function withGitRepo(defaultBranch: string, currentBranch: string, fn: (repoDir:
   const repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-careful-git-'));
   try {
     const git = (args: string[]) =>
-      spawnSync('git', ['-c', 'user.email=t@test', '-c', 'user.name=t', ...args], { cwd: repoDir, timeout: 5000 });
+      spawnSync('git', ['-c', 'user.email=t@test', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', '-c', 'tag.gpgsign=false', ...args], { cwd: repoDir, timeout: 5000 });
     git(['init', '-q', '-b', defaultBranch]);
     git(['commit', '--allow-empty', '-q', '-m', 'init']);
     // A symbolic ref may dangle; the hook only reads its NAME.

test/review-log.test.ts

@@ -145,7 +145,7 @@ describe('gstack-wtree', () => {
     const repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-wtree-'));
     try {
       const git = (args: string) =>
-        execSync(`git -c user.email=t@test -c user.name=t ${args}`, { cwd: repoDir, encoding: 'utf-8', timeout: 10000 });
+        execSync(`git -c user.email=t@test -c user.name=t -c commit.gpgsign=false -c tag.gpgsign=false ${args}`, { cwd: repoDir, encoding: 'utf-8', timeout: 10000 });
       git('init -q -b main');
       fs.writeFileSync(path.join(repoDir, 'a.txt'), 'hello\n');
       fs.writeFileSync(path.join(repoDir, '.gitignore'), 'scratch.txt\n');
@@ -177,7 +177,7 @@ describe('gstack-wtree', () => {
     withScratchRepo((repoDir, wtree) => {
       fs.writeFileSync(path.join(repoDir, 'a.txt'), 'edited\n');
       const dirtyFingerprint = wtree();
-      execSync('git -c user.email=t@test -c user.name=t commit -q -am edit', { cwd: repoDir, timeout: 10000 });
+      execSync('git -c user.email=t@test -c user.name=t -c commit.gpgsign=false commit -q -am edit', { cwd: repoDir, timeout: 10000 });
       expect(wtree()).toBe(dirtyFingerprint);
     });
   });