test(git): hermetic fixtures for issue-create harnesses (#1282-#1287)

test-issue-create-body-safety.sh and test-issue-create-interactive-auth.sh
inherited the seat's real HOME and global git config. With the #1280 fix
activating identity mode BEFORE the tea path, a workstation-global
mosaic.gitIdentity resolved inside the fixture repo, and the wrapper's
API fallback posted to the LIVE forge with a real per-slot token — six
real issues (#1282-#1287, authored mos-dt-0, closed with provenance by
fred within the hour).

Neutralize the source the resolver actually reads, and prove it by making
the resolution fail. A control that does not make the thing fail has not
been shown to control it. The earlier attempted neutralization pinned
MOSAIC_CREDENTIALS_FILE to a fake — a real guard aimed at an adjacent
input: the identity arm reads the per-slot token file directly and never
consults credentials.json. Hence env -i with a fake HOME and
GIT_CONFIG_GLOBAL=/dev/null (severing the global identity) rather than
one more targeted variable, plus a curl tripwire stub in the body-safety
harness so ANY provider request is a loud test failure instead of a live
write.

packages/mosaic/framework/tools/git/test-issue-create-interactive-auth.sh

@@ -47,14 +47,31 @@ SH
 chmod +x "$BIN_DIR/tea" "$BIN_DIR/curl"
 
 run_wrapper() {
+  # Hermetic: fake HOME (fixture credentials only, no token slots, no tea
+  # config) and GIT_CONFIG_GLOBAL severed — `git config --get
+  # mosaic.gitIdentity` otherwise resolves the WORKSTATION's global identity
+  # and reroutes the wrapper into identity mode before the tea paths this
+  # harness exercises (#1280 family; see test-issue-create-body-safety.sh).
+  # An `env …` prefix (used for MOSAIC_TEA_STALE_USER) is re-wrapped, not
+  # doubled: arguments beginning with "env" are shifted past.
+  local env_pairs=()
+  if [[ "${1:-}" == "env" ]]; then
+    shift
+    while [[ "$#" -gt 0 && "$1" == *=* ]]; do
+      env_pairs+=("$1")
+      shift
+    done
+  fi
   (
     cd "$REPO_DIR"
-    PATH="$BIN_DIR:$PATH" \
-    MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
-    MOSAIC_TEST_LOG="$LOG_FILE" \
-    "$@"
+    env -i HOME="$WORK_DIR/home" PATH="$BIN_DIR:$PATH" \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
+      MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
+      MOSAIC_TEST_LOG="$LOG_FILE" "${env_pairs[@]}" \
+      "$@"
   )
 }
+mkdir -p "$WORK_DIR/home"
 
 : > "$LOG_FILE"
 printf 'Interactive title\nInteractive body\nlabel-a,label-b\nM1\n' | run_wrapper "$SCRIPT_DIR/issue-create.sh" -i >/dev/null