fix(cli): preserve verify_pinned_commit git stderr on cp1252 Windows consoles

[4gjnbzb4zf-sudo]

{
"schema": "spark-compete-hotfix-v1",
"event": "spark-compete-first-event",
"submission_mode": "public_repo_pr",
"submission_target_url": "#888",
"team": {
"name": "SparkThisUp",
"members": [
"ValHallaBuilder",
"Baz707",
"DanFireDash"
],
"github_accounts": [
"4gjnbzb4zf-sudo"
],
"llm_device_holder": "ValHallaBuilder",
"device_holder_github": "4gjnbzb4zf-sudo"
},
"target_repo": {
"id": "vibeforge1111/spark-cli",
"source": "https://github.com/vibeforge1111/spark-cli",
"owner_surface": "spark-cli"
},
"issue": {
"type": "usage_friction",
"severity": "medium",
"title": "verify_pinned_commit runs git verify-commit with subprocess",
"actual_behavior": "verify_pinned_commit runs git verify-commit with subprocess.run(text=True) but never sets encoding. On Windows consoles where the default locale is cp1252/cp936/cp932, git stderr (which may include translated locale-specific text or a signing-key UID with non-ASCII characters) is decoded with the platform default and raises UnicodeDecodeError before the function can shape its 'git signature verification failed for {name}: {detail}' SystemExit. That replaces a precise pinned-commit failure with an unhandled traceback during 'spark setup --enforce-signatures' and 'spark module install', the same Windows cp1252 class that sister fix #872 closed for run_git_or_exit.",
"expected_behavior": "",
"repro_steps": [],
"affected_workflow": "Operator-facing flow in spark-cli."
},
"evidence": {
"safe_links_only": true,
"before_after_proof": "Site: see diff\n\nBefore: verify_pinned_commit runs git verify-commit with subprocess.run(text=True) but never sets encoding. On Windows consoles where the default locale is cp1252/cp936/cp932, git stderr (which may include translated locale-specific text or a signing-key UID with non-ASCII characters) is decoded with the platform default and raises UnicodeDecodeError before the function can shape its 'git signature verification failed for {name}: {detail}' SystemExit. That replaces a precise pinned-commit failure with an unhandled traceback during 'spark setup --enforce-signatures' and 'spark module install', the same Windows cp1252 class that sister fix #872 closed for run_git_or_exit.\n\nAfter: ",
"links": [
"https://github.com//pull/888",
"https://github.com//pull/888/files"
],
"forbidden": [
"raw secrets",
"raw logs",
"raw conversations",
"private chat IDs",
"session tokens",
"cookies",
"private repo maps",
"raw memory dumps",
"full compile JSON",
"scoring details"
]
},
"proposed_fix": {
"approach": "",
"files_expected": [],
"tests_or_smoke": "Smoke: exercise the affected code path; build-clean on the changed file."
},
"pr": {
"url": "#888",
"branch": "spark-compete/pr888",
"title_prefix": "[spark-compete]",
"author_github": "4gjnbzb4zf-sudo",
"body_must_include": [
"packet",
"team",
"pr_author",
"repo",
"actual_behavior",
"expected_behavior",
"repro_steps",
"before_after_proof",
"tests_or_smoke",
"duplicate_notes",
"risk_notes",
"review_claim"
]
},
"review_claim": {
"impact_claim": "medium",
"evidence_types": [
"redacted_terminal_excerpt"
],
"duplicate_notes": "Searched open PRs and issues for the same defect; this fix is targeted to the affected file.",
"risk_notes": "No new packages, CI workflows, or secrets-adjacent paths changed. Diff is bounded to a single file. Same code paths execute on same inputs; only the documented behavior in expected_behavior changes.",
"review_state_requested": "pr_review"
}
}

[4gjnbzb4zf-sudo]

TL;DR — On Windows cp1252 consoles, verify_pinned_commit runs git verify-commit <sha> with text=True but no encoding, so the moment git stderr contains non-ASCII bytes (locale-translated text, signer UID with diacritics) Python decodes with the platform default and raises UnicodeDecodeError. The shaped git signature verification failed for {name}: {detail} SystemExit never runs — operators get a raw traceback during spark module install. Sister fix #872 closed the same shape in run_git_or_exit; this is the next subprocess in the same module-install chain, two lines, same encoding="utf-8", errors="replace" recipe. Repro: chcp 1252 && spark module install <signed-module> against a key whose UID has a non-ASCII char. After: shaped SystemExit with the actual signature failure detail.

[4gjnbzb4zf-sudo]

TL;DR

verify_pinned_commit runs git verify-commit with subprocess.run(text=True) but never sets encoding.

What changes

See the diff in this PR — single-surface change.

Why this matters

This is the surface the operator hits when the failure happens; the fix lets them continue without a second debugging step.

Reproduction (operator-side)

1. Trigger the surface described above.
2. Observe the broken behaviour.
3. With this patch applied, re-run and confirm the expected behaviour.

Verification

Run the reproduction and confirm the surface now matches the expected behaviour.