ci_mirror: run flutter with the git hook's environment stripped

The pre-push gate failed on `flutter analyze` with "The current Flutter SDK
version is 0.0.0-unknown", while the same command passed when run by hand.

`git push` exports GIT_DIR to its hooks, and the flutter tool shells out to
git to identify its own SDK. With GIT_DIR set it reads THIS repository
instead of /opt/flutter -- `flutter --version` inside the hook reports

    Flutter 3.47.0-0.1.pre • channel main • https://github.com/kuhyx/diet-guard
    Framework • revision 84bd5503 (our own HEAD)

so pub cannot resolve any SDK constraint and every dependency is "forbidden".
Worse, flutter writes that answer into its own version cache, so the next
caller -- in any repo -- inherits it until something repairs it.

Wrapping the two flutter calls in `env -u GIT_DIR ...` fixes it at the point
of use. Not `--no-verify`: the gate was right that something was wrong, it
just was not the code being pushed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/ci_mirror.sh

@@ -88,6 +88,19 @@ run_pytest_clean_venv() {
     "$VENV_DIR/bin/python" -m pytest "$@" || fail "pytest (clean requirements.txt venv)"
 }
 
+# Run flutter with the calling git hook's environment stripped.
+#
+# `git push` exports GIT_DIR (and friends) to its hooks, and the flutter tool
+# shells out to git to identify its own SDK. With GIT_DIR set it reads THIS
+# repository instead of /opt/flutter: `flutter --version` then reports our
+# HEAD as the framework revision and our URL as the repository, pub resolves
+# the SDK as `0.0.0-unknown`, every version constraint fails, and the wrong
+# answer is written into flutter's own version cache for the next caller.
+flutter_clean_env() {
+    env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX \
+        -u GIT_COMMON_DIR -u GIT_OBJECT_DIRECTORY flutter "$@"
+}
+
 # Gate the Flutter companion app the same way: analyze (pre-commit has no Dart
 # hooks) then the full test suite. Deliberately fails rather than skips when
 # flutter is missing -- a gate that quietly passes on a machine without the
@@ -101,9 +114,9 @@ run_flutter_gates() {
         fail "flutter is not on PATH but app/ exists (cannot verify the app)"
     fi
     log "flutter analyze (app/)"
-    (cd "$APP_DIR" && flutter analyze) || fail "flutter analyze"
+    (cd "$APP_DIR" && flutter_clean_env analyze) || fail "flutter analyze"
     log "flutter test (app/)"
-    (cd "$APP_DIR" && flutter test) || fail "flutter test"
+    (cd "$APP_DIR" && flutter_clean_env test) || fail "flutter test"
 }
 
 main() {