checkpoints: scrub GIT_* env when shelling out to shadow git

ober

a74ca6b51ad85ab500a96e17683e5a82db2acf4d

diff --git a/.gitignore b/.gitignore
index c7e96da..a1465f3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,7 @@ jcode.json
 /.jcode/
 /.jerboa/
 /jcode.log
+/jcode.trace
 /.claude/
 
 # Cross-compile / boot-image build artifacts
diff --git a/src/jcode/core/checkpoints.ss b/src/jcode/core/checkpoints.ss
index d482af6..6d54ef8 100644
--- a/src/jcode/core/checkpoints.ss
+++ b/src/jcode/core/checkpoints.ss
@@ -64,7 +64,10 @@
 
 (def (run-git-or-fail args)
   ;; Run `git <args>` with the shadow git-dir, return (stdout . exit).
-  (let ((cmd (format "git --git-dir=~a --work-tree=~a ~a"
+  ;; Clear inherited GIT_* env vars so we don't accidentally write to the
+  ;; outer repo's index/objects when invoked from inside a `git commit`
+  ;; hook (which exports GIT_INDEX_FILE, GIT_DIR, GIT_OBJECT_DIRECTORY).
+  (let ((cmd (format "env -u GIT_INDEX_FILE -u GIT_DIR -u GIT_WORK_TREE -u GIT_OBJECT_DIRECTORY -u GIT_PREFIX -u GIT_AUTHOR_DATE -u GIT_COMMITTER_DATE git --git-dir=~a --work-tree=~a ~a"
                      (shell-q (checkpoint-git-dir))
                      (shell-q (current-directory))
                      args)))