refactor(storage): centralize sanitized Git subprocess execution

[seekskyworld]

Problem

Git subprocess setup is repeated across git-worktree-child-executor.ts, workspace-identity.ts, and project-catalog.ts. Each copy assembles -C, timeout, buffers, and a sanitized environment independently, while the worktree executor also maintains separate text and byte output wrappers. This is a security-sensitive boundary: an inherited GIT_DIR, GIT_WORK_TREE, or GIT_COMMON_DIR must never redirect a command away from the path being checked.

Scope

• Add a storage-local Git execution helper for text and byte output.
• Centralize removal of ambient repository-selection variables while retaining an explicit GIT_INDEX_FILE override for patch capture.
• Migrate the three existing callers without changing their timeouts, buffer limits, arguments, or public errors.
• Add a regression test that supplies poisoned Git environment variables and verifies commands still resolve the requested repository.

Acceptance criteria

• All three callers use the same sanitized environment policy and no longer duplicate subprocess option assembly.
• Text and binary output keep their existing encodings and size limits.
• The poisoned-environment test passes on the supported host platforms.

This implements the Git execution wrapper slice identified by #1404.

[seekskyworld]

我认领这个 Git 执行切片。会统一 storage 内三处 Git subprocess 的环境清理、超时/缓冲选项和 text/bytes 输出路径，保留显式 GIT_INDEX_FILE，加入污染环境回归测试；不修改 Desktop 的独立 Git review 边界。