The npm install's node_modules/.bin was prepended to PATH at script
scope, so every later step (git, gh with the agent token, curl, uv
sync, the docs publish) ran with package-controlled binaries first on
PATH; a compromised dependency shipping a bin named git or gh would
have executed with the full systemd-injected token environment. The
bin dir is now captured once as CLAUDE_CLI_BIN and prepended only
inside the two env -i allowlists that need claude: the version probe
and the pytest invocation (cli_driver re-derives its allowlist from
the pytest env). A structural test pins the exactly-two prepends and
rejects any script-scope PATH reassignment. Anchor lookups in the
touched test files now fail via pytest.fail naming the missing anchor
instead of raising a bare ValueError.
d23f919e2c