feat(release): build verified full-registry catalog candidates

tools/release/govoplan_release/catalog_entry_synthesis.py

@@ -19,6 +19,7 @@ from typing import Iterator
 from govoplan_core.core.modules import ModuleManifest
 from govoplan_core.core.versioning import version_satisfies_range
 
+from .git_state import sanitized_git_environment, scoped_git_command
 from .workspace import load_repository_specs, resolve_repo_path
 
 
@@ -255,20 +256,19 @@ def materialized_source_tree(root: Path, *, source_ref: str | None) -> Iterator[
         source_root = temporary / "source"
         source_root.mkdir()
         result = subprocess.run(
-            [
-                "git",
-                "-C",
-                str(root),
+            scoped_git_command(
+                root, "-C", str(root),
                 "archive",
                 "--format=tar",
                 f"--output={archive_path}",
                 source_ref,
-            ],
+            ),
             check=False,
             stdout=subprocess.DEVNULL,
             stderr=subprocess.PIPE,
             text=True,
             timeout=30,
+            env=sanitized_git_environment(),
         )
         if result.returncode != 0:
             detail = result.stderr.strip() or "Git archive failed"