Contains `safe_git_env` and related helpers that sanitize the environment before invoking git: removes repo-local `bin` from PATH, sets `--no-optional-locks`, `core.fsmonitor=false`, `core.pager=cat`, `diff.external=`, `diff.renames=false`, and `pager.diff=cat`. This is a reusable pattern for any tool that shells out to git and needs to prevent config/pager/alias injection.

Implements `validate_evidence_file` (rejects outside-repo and symlinked paths) and `sensitive_repo_risk_path` (detects secrets in paths like `.env/design-tokens.json`, `tokens/production.json`). These are self-contained validation routines that can be extracted for any file-ingestion or secret-scanning feature.

Novel test pattern that creates a temp Git repo, sets author/committer env vars, and runs helper functions via `runpy.run_path` with fake executables on PATH to assert exact CLI flags and isolation behavior. Demonstrates how to test subprocess-heavy code without real external dependencies.