Function resolve_git_binary 

pub fn resolve_git_binary() -> PathBuf

Resolves git, preferring [GIT_BIN_ENV], then the first existing well-known absolute path, then bare git on PATH.

This is the fix for the real obstacle to running git from the daemon (ADR-0059). The obstacle was never credentials — launchd exports SSH_AUTH_SOCK into the per-user session, so a LaunchAgent inherits the user’s ssh-agent — it was the minimal PATH, the same problem ADR-0049 §3 solves for the code launcher and resolve_gh_binary solves for gh.

Callers should do this once and pass the result down, rather than re-reading the environment per subprocess.