fix(tool): capture stdout-only when resolving git top-level

Address review: CombinedOutput could merge git stderr warnings into the
resolved path; use Output() so the top-level path stays clean.

Author: chethanuk

cmd/opencodereview/git.go

@@ -12,6 +12,15 @@ func runGitCmd(repoDir string, args ...string) ([]byte, error) {
 	return cmd.CombinedOutput()
 }
 
+// runGitCmdStdout is like runGitCmd but returns stdout only. Use it when the
+// output is consumed as data (e.g. a resolved path) so git's stderr warnings
+// (permissions, deprecations, config notices) can't pollute the result.
+func runGitCmdStdout(repoDir string, args ...string) ([]byte, error) {
+	fullArgs := append([]string{"-C", repoDir}, args...)
+	cmd := exec.Command("git", fullArgs...)
+	return cmd.Output()
+}
+
 func getCommitMessage(repoDir, commit string) (string, error) {
 	out, err := runGitCmd(repoDir, "log", "-1", "--format=%B", "--end-of-options", commit)
 	if err != nil {

cmd/opencodereview/shared.go

@@ -108,7 +108,7 @@ func resolveWorkingDir(input string, requireGit bool) (string, bool, error) {
 	// requireGit is true only for the review path; scan (requireGit=false) keeps
 	// the CWD so its `git ls-files` walk stays scoped to the subdirectory.
 	if isGit && requireGit {
-		if top, topErr := runGitCmd(absPath, "rev-parse", "--show-toplevel"); topErr == nil {
+		if top, topErr := runGitCmdStdout(absPath, "rev-parse", "--show-toplevel"); topErr == nil {
 			if t := strings.TrimSpace(string(top)); t != "" {
 				absPath = t
 			}