Function hermetic_command 

pub fn hermetic_command(program: &str, dir: &Path) -> Command

As git_command, for a program that is not git itself but will shell out to it — cargo, whose build scripts invoke git, is the motivating case. The redirecting variables are inherited all the way down a process tree, so scrubbing only the direct git calls would leave that path open.

The scrub is unconditional: there is no bypass parameter, no environment variable, and no config lookup that can turn it back on. There is no legitimate reason a DevFlow-issued command should silently redirect via an inherited variable — an operator who wants DevFlow to act on a different repository passes it a different path (D-01).