GeezerVison

Port PR #2306's regression against direct `git commit` and `git hook`
invocations. Before this fix, `Repo`'s automatic `GIT_DIR` binding made
Git treat the repository as explicitly selected: `IndexFile.commit()`
ran its pre-commit hook even when ordinary Git rejected dubious
ownership. The regression fails on both backends without the fix.

Retain the original discovery location and run `git rev-parse --git-dir`
before executing any commit hook, removing only the automatically bound
environment values. Remembering discovery supports external
`core.worktree` locations while matching `safe.directory` on ordinary,
bare, linked and separate-directory repositories. Explicit environment
or command-line repository selections retain Git's behavior, including
relative paths and consumption of one-shot options after failures.
Validate NUL arguments before starting either process.

The fixture tests verify rejection without hook side effects, Git's
safe-directory exemptions, and explicit repository-selection behavior.
Update the native-backend coverage test and GIX-23 documentation to
require two CLI processes per valid hook request, including missing
hooks. No independent ownership policy or native hook implementation
is introduced.

Validation: before the final option-preservation refinements, the full
index, repository and backend modules passed (CLI: 236 tests, 106 skips;
Gix: 338 tests, 4 skips; each with 19 passing subtests). Final focused
hook coverage passes with CLI (12 tests, 2 skips) and Gix (14 tests),
each with 9 passing subtests. A separate review independently reran the
ownership and repository-selection regressions on both backends.
`ruff check`, targeted `mypy`, fixture `bash -n` and `git diff --check`
pass. Windows and Linux were not run locally.

Port PR #2306's regression against direct `git commit` and `git hook`
invocations. Before this fix, `Repo`'s automatic `GIT_DIR` binding made
Git treat the repository as explicitly selected: `IndexFile.commit()`
ran its pre-commit hook even when ordinary Git rejected dubious
ownership. The regression fails on both backends without the fix.

Retain the original discovery location and run `git rev-parse --git-dir`
before executing any commit hook, removing only the automatically bound
environment values. Remembering discovery supports external
`core.worktree` locations while matching `safe.directory` on ordinary,
bare, linked and separate-directory repositories. Explicit environment
or command-line repository selections retain Git's behavior, including
relative paths and consumption of one-shot options after failures.
Validate NUL arguments before starting either process.

The fixture tests verify rejection without hook side effects, Git's
safe-directory exemptions, and explicit repository-selection behavior.
Update the native-backend coverage test and GIX-23 documentation to
require two CLI processes per valid hook request, including missing
hooks. No independent ownership policy or native hook implementation
is introduced.

Validation: before the final option-preservation refinements, the full
index, repository and backend modules passed (CLI: 236 tests, 106 skips;
Gix: 338 tests, 4 skips; each with 19 passing subtests). Final focused
hook coverage passes with CLI (12 tests, 2 skips) and Gix (14 tests),
each with 9 passing subtests. A separate review independently reran the
ownership and repository-selection regressions on both backends.
`ruff check`, targeted `mypy`, fixture `bash -n` and `git diff --check`
pass. Windows and Linux were not run locally.