fix(studio): review round 1 (symlink-safe writes, remote allowlist, upload cap/types/no-overwrite, owner rule at publish/sync/resolve, studio/repos layout and read-only imports, side-effect-free list)

C1: writes lstat every path component and refuse symlinks (dangling included),
check the parent's real path after mkdir, and open with O_NOFOLLOW.
I1: only https://, ssh:// and git@host: remotes; protocol.file/ext/fd=never on
every fetch and push; global/system git config ignored.
I2: STC_UPLOAD_MAX_MB cap (default 100) by Content-Length and while streaming;
extension allowlist (415); stcourse.yaml refused; 409 unless overwrite=true;
sandboxing CSP on draft raw files.
I3: owner-only visibility/source.kind rule checked on the merged result at
publish and sync, and at resolve; publish also validates the merged tree.
I4: bare repos in <dataDir>/studio/repos/<id>.git; imported courses read-only.
I5: list status comes from the bare repo; drafts are created lazily.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/feature-studio/src/server/git.ts

@@ -20,6 +20,9 @@ function env(who?: Identity): Record<string, string> {
     if (v !== undefined && !k.startsWith("GIT_")) e[k] = v; // never inherit GIT_DIR, GIT_INDEX_FILE, ...
   }
   e.GIT_TERMINAL_PROMPT = "0";
+  // Ignore the machine's global/system git config (url.*.insteadOf, credential helpers, ...).
+  e.GIT_CONFIG_GLOBAL = "/dev/null";
+  e.GIT_CONFIG_NOSYSTEM = "1";
   e.GIT_SSH_COMMAND = "ssh -o BatchMode=yes";
   // A fallback identity so git never refuses a merge/commit; real saves always pass `who`.
   const id = who ?? { name: "STCourses", email: "[email protected]" };