fleetd #369: state hermeticGitEnv's real scope, measured

The comment claimed no test in this class can reach the real machine's home
directory. Measured on the merge: 53 of the 58 new GitWorktrees(...)
constructions here pass no env override, and stripping the override from
seedingGitWorktrees leaves the class green under the poison command that the
same comment cites as proof. Say what it covers and what it does not.

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -1529,7 +1529,15 @@ class GitWorktreesTest {
      * an empty, machine-independent {@code XDG_CONFIG_HOME} (so the fallback resolves to a file that
      * provably does not exist) plus the same {@code GIT_CONFIG_GLOBAL}/{@code GIT_CONFIG_SYSTEM}/
      * {@code GIT_TERMINAL_PROMPT} isolation the {@link #git}/{@link #gitOutput} helpers already use
-     * for repo setup — so no test in this class can reach the real machine's home directory.
+     * for repo setup.
+     *
+     * <p>Scope, measured on the fleetd #369 merge and narrower than an earlier version of this
+     * comment claimed: this protects the 5 {@link #seedingGitWorktrees} sites plus — through
+     * {@link #gitProcessBuilder} — every {@code git} subprocess the TEST itself starts. It does
+     * NOT cover the other 53 {@code new GitWorktrees(...)} constructions in this file, which pass
+     * no env override, so a production instance built that way still inherits the JVM's real
+     * environment. Stripping this override from {@code seedingGitWorktrees} leaves the class green
+     * both with and without the poison command above, so that half is currently unpinned.
      */
     private static Map<String, String> hermeticGitEnv(Path tmp) {
         return Map.of(