Slice 8: configure git credentials + identity in the container

On startup the app runs git config --global to set a commit identity (GIT_USER_NAME/GIT_USER_EMAIL), safe.directory=* for host-owned mounts, and http.<GITEA_URL>.extraheader with the Gitea token so push/fetch/pull authenticate over HTTPS without an SSH key. New git.CLI.SetGlobalConfig and config fields. Verified: fetch via the app works and the identity/header are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENT.md

@@ -548,8 +548,12 @@ silently guess.)*
   branch delete) and how it is provisioned; document in `.env.example`.
 - **Listen address / exposure:** localhost‑only by default (covers `/mcp` too).
   Confirm before binding to a non‑local interface — there is no auth (Section 0).
-- **Credential path from the container:** SSH agent socket vs mounted keys vs
-  credential helper, for pushing/fetching from inside Docker.
+- ✅ **RESOLVED 2026-09-20:** **Container git auth = the Gitea token over HTTPS.**
+  On startup the app runs `git config --global` to set a commit identity
+  (`GIT_USER_NAME`/`GIT_USER_EMAIL`), `safe.directory=*` (host-owned mounts), and
+  `http.<GITEA_URL>.extraheader: Authorization: token …` so push/fetch/pull work
+  without SSH keys. The token lands in the container's gitconfig (ephemeral,
+  localhost). An SSH-key path stays possible later for non-Gitea remotes.
 
 ---