fix(hub): never lazy-fetch a missing object in the worktree scan

Agents write the repos the tree view scans. A repo with remote.<name>.promisor=true and a ref to a missing object made for-each-ref fetch it, and that fetch ran the repo's remote.<name>.uploadpack through sh inside the hub container. The scan's git env now sets GIT_NO_LAZY_FETCH=1 (the image ships git 2.47, which honours it); the new test proves no uploadpack runs.

🎯 Fix: 95 %
💥 Break: 1 %
💸 Cost: –
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 94
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/kvb_hub/tree.py

@@ -18,7 +18,7 @@ GIT_TIMEOUT = 10
 
 
 def git(cwd: Path, args: list[str], home: Path) -> str | None:
-    env = {"PATH": SAFE_PATH, "HOME": str(home), "GIT_CONFIG_NOSYSTEM": "1", "GIT_OPTIONAL_LOCKS": "0", "GIT_TERMINAL_PROMPT": "0", "LC_ALL": "C"}
+    env = {"PATH": SAFE_PATH, "HOME": str(home), "GIT_CONFIG_NOSYSTEM": "1", "GIT_NO_LAZY_FETCH": "1", "GIT_OPTIONAL_LOCKS": "0", "GIT_TERMINAL_PROMPT": "0", "LC_ALL": "C"}
     try:
         done = subprocess.run(
             ["git", "-c", "safe.directory=*", "-c", "core.fsmonitor=false", "-C", str(cwd), *args],

tests/test_hub_tree.py

@@ -67,6 +67,25 @@ class TestHubTree(HubCase):
         self.assertEqual(dirty, {"github.com/me/trap": False, "github.com/me/filtered": None})
         self.assertFalse(marker.exists())
 
+    def test_tree_never_fetches_a_missing_object(self):
+        marker = self.outside / "fetched"
+        origin = self.outside / "lazy.git"
+        self.git(self.outside, "init", "--quiet", "--bare", "--initial-branch=main", str(origin))
+        repo = self.repos / "github.com" / "me" / "lazy"
+        repo.mkdir(parents=True)
+        self.git(repo, "init", "--quiet", "--initial-branch=main")
+        (repo / "a.txt").write_text("a", encoding="utf-8")
+        self.git(repo, "add", "a.txt")
+        self.git(repo, "commit", "--quiet", "-m", "a")
+        self.git(repo, "remote", "add", "origin", str(origin))
+        self.git(repo, "push", "--quiet", "-u", "origin", "main")
+        self.git(repo, "config", "remote.origin.promisor", "true")
+        self.git(repo, "config", "remote.origin.uploadpack", f"touch {marker}; git-upload-pack")
+        (repo / ".git" / "refs" / "remotes" / "origin" / "main").write_text("1" * 40 + "\n", encoding="utf-8")
+        status, _, body = self.get("/api/tree")
+        self.assertEqual(status, 200, body)
+        self.assertFalse(marker.exists())
+
 
 if __name__ == "__main__":
     unittest.main()