feat(release): build verified full-registry catalog candidates

tools/release/generate-release-package-set.py

@@ -9,6 +9,7 @@ import json
 from pathlib import Path
 import re
 import subprocess
+import sys
 import tomllib
 
 
@@ -216,10 +217,17 @@ def _extras(value: str | None) -> list[str]:
 
 
 def _git(repository: Path, *arguments: str) -> str:
+    release_root = str(Path(__file__).resolve().parent)
+    if release_root not in sys.path:
+        sys.path.insert(0, release_root)
+    from govoplan_release.git_state import sanitized_git_environment, scoped_git_command
+
     return subprocess.check_output(
-        ["git", "-C", str(repository), *arguments],
+        scoped_git_command(repository, "-C", str(repository), *arguments),
         text=True,
         stderr=subprocess.DEVNULL,
+        env=sanitized_git_environment(),
+        timeout=30,
     ).strip()