fix: address Copilot review feedback on mock ordering and type safety

- Use dynamic import in test to guarantee mock bindings are active
- Type SAFE_GIT_ENV as NodeJS.ProcessEnv instead of casting Record<string, string>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gn00295120

src/github/operations/restore-config.ts

@@ -23,7 +23,7 @@ const GIT_TIMEOUT_MS = 60_000;
 
 // Environment overrides that prevent git from hanging on credential prompts or
 // recursing into submodules. Applied to every git subprocess in this module.
-const SAFE_GIT_ENV: Record<string, string> = {
+const SAFE_GIT_ENV: NodeJS.ProcessEnv = {
   ...process.env,
   // Prevent git from opening an interactive credential prompt (would block the
   // runner forever in a non-interactive CI environment).
@@ -33,7 +33,7 @@ const SAFE_GIT_ENV: Record<string, string> = {
   // can cause git to fetch/update submodules, which may hang indefinitely
   // if the submodule URLs require authentication not available to the runner.
   GIT_SUBMODULE_UPDATE_COMMAND: "true",
-} as Record<string, string>;
+};
 
 /**
  * Restores security-sensitive config paths from the PR base branch.

test/restore-config.test.ts

@@ -1,21 +1,21 @@
 import { describe, it, expect, mock, beforeEach } from "bun:test";
-import { execFileSync } from "child_process";
-import { rmSync } from "fs";
 
-// Mock child_process and fs before importing the module under test
+// Create mock functions first, then register them with mock.module
+const mockedExecFileSync = mock(() => undefined);
+const mockedRmSync = mock(() => undefined);
+
 mock.module("child_process", () => ({
-  execFileSync: mock(() => undefined),
+  execFileSync: mockedExecFileSync,
 }));
 
 mock.module("fs", () => ({
-  rmSync: mock(() => undefined),
+  rmSync: mockedRmSync,
 }));
 
-// Import after mocking
-import { restoreConfigFromBase } from "../src/github/operations/restore-config";
-
-const mockedExecFileSync = execFileSync as unknown as ReturnType<typeof mock>;
-const mockedRmSync = rmSync as unknown as ReturnType<typeof mock>;
+// Dynamic import after mocking to guarantee bindings point to mocks
+const { restoreConfigFromBase } = await import(
+  "../src/github/operations/restore-config"
+);
 
 describe("restoreConfigFromBase", () => {
   beforeEach(() => {