feat: pin git runtime for git pusher

[sbalabanov]

Summary

• pin Git 2.55.0 from the Bazel Central Registry
• inject absolute Git executable, helper, and template paths into the Git pusher
• construct a controlled Git environment instead of inheriting host configuration
• run the real-git tests against the Bazel-built runtime and assert its version
• remove the PATH lookup and test skip when host Git is unavailable

This intentionally implements the source-built BCR option. The resulting Git binary still uses the host libc and the BCR build's /bin/sh.

Validation

• ./tool/bazel test //submitqueue/extension/pusher/git:go_default_test --nocache_test_results --test_output=errors
• ./tool/bazel test //... --test_tag_filters=-manual,-integration --test_output=errors
• make check-tidy
• make check-gazelle
• make lint

The Git pusher test runs in approximately 2.7 seconds after the one-time BCR Git build.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}