…him (#436 §E follow-up)

Ports the last open §E item — upstream's [`fetching/git-fetcher/test/index.ts:183`](https://github.com/pnpm/pnpm/blob/94240bc046/fetching/git-fetcher/test/index.ts#L183)
`still able to shallow fetch for allowed hosts` test, which jest-mocks
`execa` to spy on the git argv.

Pacquet can't intercept `Command::new("git")` without changing
production code, so the test instead:

1. Writes a `/bin/sh` shim at `<tempdir>/shim/git` that appends each
   invocation (tab-separated argv) to a log file and fakes
   `rev-parse HEAD` so the fetcher's commit-match check passes.
2. Prepends the shim directory to `PATH` for the duration of the
   test body via `unsafe { std::env::set_var(...) }`. Edition 2024
   requires `unsafe` here; the project's `cargo nextest` runner
   isolates each test in its own process, so no sibling test in
   the same binary can race the modified env.
3. Parses the log and asserts the shallow sequence:
   `git init` → `git remote add origin <url>` →
   `git fetch --depth 1 origin <commit>`, with `git clone` absent.

`fetcher_clones_when_host_not_in_shallow_list` is the mirror — same
shim, empty `git_shallow_hosts`, asserts `git clone <url> <dir>`
appears and `init` / `fetch` don't. Together the two tests pin the
gate's polarity end-to-end (the existing
`should_use_shallow_matches_known_host` unit test only covers the
predicate, not the argv shape).

Unix-only via `#[cfg(unix)]` — a Windows mirror would need a `.cmd`
shim and a different launcher. The
`should_use_shallow_matches_known_host` cross-platform unit test
still covers the predicate on Windows.

Manually verified the tests catch a regression: temporarily
inverting the `should_use_shallow` gate flipped both tests to red
with the exact argv mismatch in the panic message.

… guard)

CodeRabbit / Copilot on #487:

- **Shell injection.** The shim's `format!("printf '%s\\n' {commit:?}")` baked the temp paths and fake commit into the script body via Rust debug-quoting, which wraps in `"..."` and leaves `$` / backticks / `\` open to /bin/sh re-interpretation. A `TMPDIR` containing those characters would either fail the test or execute attacker-controlled shell. Fixed by reading both paths/values from env vars (`PACQUET_GIT_SHIM_LOG`, `PACQUET_GIT_SHIM_FAKE_COMMIT`) at run time — the shim body is now a static string.

- **PATH race under `cargo test`.** The previous version relied on `cargo nextest`'s one-process-per-test isolation, leaving `cargo test` susceptible to two concurrent tests racing each other's `unsafe { set_var("PATH", ...) }`. Extract `EnvGuard` from `pacquet-config`'s private `test_env_guard` into `pacquet_testing_utils::env_guard` and use it here — process-wide `Mutex` holds the env-mutation lock for the test body and `Drop` restores all three named variables. Three call sites in `pacquet-config` updated to the new path; one fewer copy of the same helper.

- **Ordering not pinned.** Positive assertions used `.any()`, so a regression that emitted `init` / `remote add` / `fetch` in the wrong order still passed. Switched to `position_of(&invocations, argv)` + a strict `init_at < remote_at < fetch_at` check.

- **Missing `remote add` absence in non-shallow test.** The clone test only rejected `init` and `fetch`; a regression that ran both the clone *and* the shallow `remote add origin` sequence would have slipped through. Now the test rejects all three shallow-branch commands.

- **Helper doc claim.** Updated `write_git_shim`'s rustdoc — it's used by both the shallow and non-shallow tests, and the non-shallow `git clone` *is* exercised through it.

Regression-catch verified for each fix (inverted gate, swapped argv order, extra `remote add` in clone branch — all flipped the relevant assertion red with the exact mismatch in the panic).

…-init

GitHub's macOS runner image started shipping `rustup-init` symlinked
as `cargo` / `rustc` in `/usr/local/bin/` ahead of the rustup proxies
that live in `~/.cargo/bin/`. The "Clippy" step in the macOS matrix
then ran `cargo clippy --locked -- -D warnings` and got back
`error: unexpected argument 'clippy' found / Usage: rustup-init[EXE]`
— rustup-init doesn't understand cargo subcommands.

`rustup show` / `rustup component add` calls still work because rustup
proper is on PATH at its normal location; only the `cargo` /  `rustc`
proxies are stomped by the runner image's preinstalled `rustup-init`.

Prepending `~/.cargo/bin` to `GITHUB_PATH` once, at the top of the
shared rustup composite action, ensures every later step picks the
rustup proxies first.

Started failing on `main` between commits 25823596870 (success) and
25823996109 (failure) on 2026-05-13, which lines up with the
GitHub-hosted macos-14 image bump that shipped with the new
rustup-init layout.

…n shim tests

Copilot review on #487 (3237379604, 3237379656): the previous shim
tests mutated process-global `PATH` under an `EnvGuard` that only
serialized the *two* shim tests against each other — sibling tests
in the same binary that call `Command::new("git")` (fixture-setup
helpers in `make_bare_repo` / `make_bare_repo_with_prepare_script`,
ad-hoc `skip_if_no_git` spawns, the other fetcher tests' end-to-end
flows) had no lock, so a parallel `cargo test -p pacquet-git-fetcher`
run could let those tests resolve `git` to the shim mid-flight and
fail unpredictably.

The fix swaps process-global `PATH` for a per-fetcher binary
override:

- New `GitFetcher::git_bin: Option<&Path>` field. Production callers
  leave it `None` (unchanged behavior: resolve `git` through `PATH`,
  matching upstream `execa('git', …)`). Tests pass a shim path
  directly, so only that one fetcher resolves through the shim.
- `exec_git` is now a `#[cfg(test)]` convenience wrapper over the
  new `exec_git_with(bin, …)` which takes the binary path explicitly.
  Production `GitFetcher::run_sync` calls `exec_git_with` with
  `self.git_bin.unwrap_or(Path::new("git"))`.
- The two shim tests now pass `git_bin: Some(&shim_path)` instead of
  prepending the shim dir to `PATH`. The only env mutation left is
  setting `PACQUET_GIT_SHIM_LOG` / `PACQUET_GIT_SHIM_FAKE_COMMIT` —
  those are read only by the shim itself, so a sibling test's real
  `git --version` invocation can't see or care about them.
  `EnvGuard` still serializes the two shim tests against each other
  so their log paths don't cross-contaminate.

Also reverts the speculative `~/.cargo/bin` PATH prepend in the
shared rustup composite action — it didn't fix the macOS Clippy
failure (proxies were never the issue) and conflated CI plumbing
with this PR's scope.

11 `GitFetcher { … }` struct literals updated to add `git_bin: None`
(10 in `fetcher/tests.rs`, 1 in `install_package_by_snapshot.rs`).