fix(tests): cso-git-hardening fixtures turn git auto-maintenance off

seedRepo commits with fixtureGit's replacement env, which never sees the
shard backstop, so each commit started a detached git maintenance run that
creates and deletes .git/objects/maintenance.lock under the tests' own .git
reads and the afterEach rmSync (docs/TESTING_INTERNALS.md, Free-suite flake
rules). Found by /ship's documentation audit; git 2.55.0 trace2 shows the
maintenance spawn with the keys unset and none with them set.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -7,7 +7,7 @@
 ### Fixed
 - **`browse/test/dotenv-isolation.test.ts`** (Free Tests 39902683183 and 40322888041, shard 2, "JSON Parse error: Unexpected EOF" at the `agent-env.json` read): the probe writes its result to a temp file and renames it into place, and `waitForFile` waits for content, not only for the file. A new test feeds the old race (an empty file filled 150 ms later) and runs the probe source itself.
 - **`test/claude-code-runner.test.ts`** (Free Tests 39694715116, shard 13, `running(pid)` false at the timeout case): the descendant publishes `descendant.pid` by rename, and the test polls `publishedPid()`, a positive integer, instead of the file's existence, so an empty read can no longer become pid 0.
-- **`test/cso-git-hardening.test.ts`** (Free Tests 40288142343, shard 17, `fs.cpSync` threw in `fixture()` with an empty message and passed on the serial retry): every fixture builds its own repository with Git instead of copying a shared template; the `beforeAll` still pays the cold macOS Git spawns once, on a throwaway repository. No timeout changed.
+- **`test/cso-git-hardening.test.ts`** (Free Tests 40288142343, shard 17, `fs.cpSync` threw in `fixture()` with an empty message and passed on the serial retry): every fixture builds its own repository with Git instead of copying a shared template, with auto-maintenance off (`maintenance.auto=false`, `gc.auto=0`) so the detached `git maintenance run` a commit starts no longer touches `.git` while a test walks or removes it; the `beforeAll` still pays the cold macOS Git spawns once, on a throwaway repository. No timeout changed.
 
 ## [1.91.246.0] - 2026-10-26
 

test/cso-git-hardening.test.ts

@@ -12,10 +12,15 @@ afterEach(()=>{for(const root of roots.splice(0))fs.rmSync(root,{recursive:true,
 const fixtureGit=(repo:string,home:string)=>(...args:string[])=>{const result=spawnSync('/usr/bin/git',['-C',repo,...args],{encoding:'utf8',env:{HOME:home,PATH:'/usr/bin:/bin'},timeout:30_000});if(result.status)throw new Error(result.stderr);return result.stdout;};
 // Each fixture builds its own repository from Git; nothing is copied from a shared
 // template (Free Tests 40288142343 shard 17: fs.cpSync of the template threw inside
-// its directory walk once and passed on the serial retry).
+// its directory walk once and passed on the serial retry). Auto-maintenance is off
+// because `git commit` otherwise starts a detached `git maintenance run --auto` that
+// creates and deletes .git/objects/maintenance.lock after the commit returns, under
+// the tests' own .git reads and the afterEach rmSync (docs/TESTING_INTERNALS.md,
+// Free-suite flake rules); fixtureGit's replacement env never sees the shard backstop.
 function seedRepo(repo:string,home:string){
   const git=fixtureGit(repo,home);fs.mkdirSync(repo);
   git('init','-q');git('config','user.email','fixture@example.test');git('config','user.name','Fixture');
+  git('config','maintenance.auto','false');git('config','gc.auto','0');
   fs.writeFileSync(path.join(repo,'tracked.ts'),'export const tracked = true\n');git('add','tracked.ts');git('commit','-qm','base');
   return git;
 }