fix(native): suppress git hooks during apply cancel

[cursor]

Summary

Fixes a native apply-cancel security gap where darwin_apply_stream_cancel used raw git invocations instead of nixmac's hardened git wrapper. A malicious or compromised config repository could run Git hooks during cancel operations (checkout/commit) despite the rest of nixmac disabling hooks via core.hooksPath=/dev/null.

Changes:

• Added a shared git::run_command helper that preserves nixmac's fixed git identity and hook suppression.
• Routed apply-cancel git operations through the hardened helper.
• Added a regression test that installs a failing pre-commit hook and verifies nixmac git commands do not run it.

Test Plan

• rustfmt --edition 2021 src/git/exec.rs src/git/mod.rs src/commands/apply.rs
• git diff --check HEAD~1..HEAD
• Direct smoke test: initialized a temp repo with an executable failing pre-commit hook, then committed with nixmac's hardened git arguments and verified hook-ran was not created.
• Attempted cargo test git::exec::tests::test_run_command_disables_repo_hooks with Cargo 1.83: blocked by an edition-2024 dependency parser error.
• Installed Rust stable 1.95 and retried cargo +stable test git::exec::tests::test_run_command_disables_repo_hooks: compilation progressed but failed before crate tests because the Linux runner lacks gdk-3.0/gdk-3.0.pc required by Tauri/Wry.

Docs

• No docs update needed

  

[github-actions]

	Warnings
⚠️	PR is marked WIP / draft — do not merge until ready for review.
⚠️	Please assign this PR to someone (usually yourself).

📋 PR Overview

Lines changed	107 (+55 / -52)
Files	0 added, 3 modified, 0 deleted
Draft / WIP	yes
Has Test Plan	yes
New UI components	no
New Storybook stories	no
New Rust modules	no
New TS source files	no
New tests	no
package.json touched	no
Cargo.toml touched	no
Infra / CI touched	no

Generated by 🚫 dangerJS against d28e051

[Cas Linden (CasLinden)]

Could be wrong and a lot of things were merged since but this command was unused and flagged for removal in my now outdated tauri-api cleanup PR