Merge branch 'codex/psec-4394-git-04d-guarded-apply' into codex/psec-4394-git-05a-apply-filters

codex-rs/git-utils/src/git_config_environment.rs

@@ -98,6 +98,7 @@ impl GitConfigEnvironmentSnapshot {
         }
     }
 
+    #[cfg_attr(not(test), allow(dead_code))]
     pub(crate) fn value(&self, name: &str) -> Option<&OsStr> {
         self.entries
             .iter()

codex-rs/git-utils/src/git_config_sources_tests.rs

@@ -40,6 +40,7 @@ fn init_repo_at(root: &Path) {
 }
 
 #[cfg(windows)]
+#[allow(dead_code)]
 fn create_junction(path: &Path, target: &Path) {
     // Bazel's GNU Windows runner can surface temporary paths with `/`
     // separators. `mklink` treats those separators as option prefixes, so