Built-in /security-review and /build-review fail with 'fatal: not a git repository' on --separate-git-dir layouts

Summary

The built-in /security-review and /build-review commands fail at the initial !git status preflight when the working tree's .git is not a colocated subdirectory — e.g., layouts created with git init --separate-git-dir, or bare-repo + GIT_DIR/GIT_WORK_TREE shell-wrapper patterns commonly used to share a dotfiles repo across machines.

Repro

mkdir /tmp/repro-worktree && cd /tmp/repro-worktree
git init --separate-git-dir=/tmp/repro.git

# In Claude Code with cwd = /tmp/repro-worktree:
/security-review
# → fatal: not a git repository (or any of the parent directories): .git

Expected

Resolve the git directory via standard env-var fallback (GIT_DIR, GIT_WORK_TREE) or git rev-parse --git-dir before running git status.

Actual

Raw git status is invoked from cwd → no .git/ subdir → exit 1, surfaced as "not a git repository".

Workaround

Run the review manually and write a project-side sidecar (in our case bin/log-review-pass <gate> PASS). This unblocks pre-push gates but defeats the purpose of the built-in commands.

Affected layouts

• git init --separate-git-dir=PATH (canonical reproducer)
• Bare-repo + GIT_DIR=…/foo.git GIT_WORK_TREE=…/work shell wrappers
• Worktrees where cwd is not the work-tree root

Environment

• Claude Code (current as of 2026-05-09)
• macOS 26.4 (Darwin 25.4)