fix: use git tracking branch instead of hardcoded origin/master in teardownSandbox

Replace explicit 'git pull --rebase origin master' with 'git pull --rebase'
(no remote/branch), which uses the upstream configured by git clone. This
correctly handles repos where the default branch is 'main', 'trunk', or
any other name — not just 'master'.

Also apply gitSafe flags (-c safe.directory=* -c commit.gpgsign=false etc)
consistently to the status, push, pull, and log commands in teardownSandbox
that were missing them.

The variable-shadowing bug noted in CLAUDE.md was already resolved in the
github/main merge (both setupSandbox calls used '=' not ':='); strike it
from the docs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 7 insertions, 5 deletions

diff --git a/internal/executor/claude.go b/internal/executor/claude.go
index 3c87f26..7b70486 100644
--- a/internal/executor/claude.go
+++ b/internal/executor/claude.go
@@ -248,7 +248,7 @@ func setupSandbox(projectDir string, logger *slog.Logger) (string, error) {
 // from mixed-owner .git/objects directories.
 func teardownSandbox(projectDir, sandboxDir, startHEAD string, logger *slog.Logger, execRecord *storage.Execution) error {
 	// Automatically commit uncommitted changes.
-	out, err := exec.Command("git", "-C", sandboxDir, "status", "--porcelain").Output()
+	out, err := exec.Command("git", gitSafe("-C", sandboxDir, "status", "--porcelain")...).Output()
 	if err != nil {
 		return fmt.Errorf("git status: %w", err)
 	}
@@ -327,16 +327,18 @@ func teardownSandbox(projectDir, sandboxDir, startHEAD string, logger *slog.Logg
 	}
 
 	// Push from sandbox → bare repo (sandbox's origin is the bare repo).
-	if out, err := exec.Command("git", "-C", sandboxDir, "push", "origin", "HEAD").CombinedOutput(); err != nil {
+	if out, err := exec.Command("git", gitSafe("-C", sandboxDir, "push", "origin", "HEAD")...).CombinedOutput(); err != nil {
 		// If rejected due to concurrent push, fetch+rebase and retry once.
+		// Use `git pull --rebase` without explicit remote/branch so git uses the
+		// configured upstream (set by clone), handling both main- and master-based repos.
 		if strings.Contains(string(out), "fetch first") || strings.Contains(string(out), "non-fast-forward") {
 			logger.Info("push rejected (concurrent task); rebasing and retrying", "sandbox", sandboxDir)
-			if out2, err2 := exec.Command("git", "-C", sandboxDir, "pull", "--rebase", "origin", "master").CombinedOutput(); err2 != nil {
+			if out2, err2 := exec.Command("git", gitSafe("-C", sandboxDir, "pull", "--rebase")...).CombinedOutput(); err2 != nil {
 				return fmt.Errorf("git rebase before retry push: %w\n%s", err2, out2)
 			}
 			// Re-capture commits after rebase (hashes might have changed)
 			execRecord.Commits = nil
-			logOut, logErr = exec.Command("git", "-C", sandboxDir, "log", logRange, "--pretty=format:%H|%s").Output()
+			logOut, logErr = exec.Command("git", gitSafe("-C", sandboxDir, "log", logRange, "--pretty=format:%H|%s")...).Output()
 			if logErr == nil {
 				lines := strings.Split(strings.TrimSpace(string(logOut)), "\n")
 				for _, line := range lines {
@@ -350,7 +352,7 @@ func teardownSandbox(projectDir, sandboxDir, startHEAD string, logger *slog.Logg
 				}
 			}
 
-			if out3, err3 := exec.Command("git", "-C", sandboxDir, "push", "origin", "HEAD").CombinedOutput(); err3 != nil {
+			if out3, err3 := exec.Command("git", gitSafe("-C", sandboxDir, "push", "origin", "HEAD")...).CombinedOutput(); err3 != nil {
 				return fmt.Errorf("git push to origin (after rebase): %w\n%s", err3, out3)
 			}
 		} else {