Slice 8: configure git credentials + identity in the container

On startup the app runs git config --global to set a commit identity (GIT_USER_NAME/GIT_USER_EMAIL), safe.directory=* for host-owned mounts, and http.<GITEA_URL>.extraheader with the Gitea token so push/fetch/pull authenticate over HTTPS without an SSH key. New git.CLI.SetGlobalConfig and config fields. Verified: fetch via the app works and the identity/header are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -201,3 +201,19 @@ Append-only running history of all changes (AGENT.md §9.1). Newest last.
 - **Affects:** `internal/mcp` (+test), `AGENT.md` (§8.1).
 - **Note:** the new tools appear in Claude Desktop only after its next restart
   (tool list cached per connection); network ops still need container git creds.
+
+## 2026-09-20 — Slice 8: git credentials + identity in the container (§11)
+- **What:** On startup the app configures the container's git (`git config
+  --global`): a commit identity (`GIT_USER_NAME`/`GIT_USER_EMAIL`),
+  `safe.directory=*` for host-owned mounts, and — when `GITEA_URL`+`GITEA_TOKEN`
+  are set — `http.<url>.extraheader: Authorization: token …` so push/fetch/pull
+  authenticate over HTTPS with no SSH key. New `git.CLI.SetGlobalConfig`; new
+  config `GIT_USER_NAME`/`GIT_USER_EMAIL`; `.env.example` documents them.
+- **Why:** Make the network git commands (menu + MCP) actually work from Docker,
+  and let commits have an author.
+- **Affects:** `internal/config`, `internal/git`, `cmd/server/main.go`,
+  `.env.example`, `AGENT.md` (§11).
+- **Verified:** startup logs "git remote auth configured"; container git identity
+  set; `http.extraheader` present; `git_fetch` via the app returned ok.
+- **Security note:** the token is written to the container's ephemeral gitconfig
+  and passed in a `git config` argv — acceptable for a localhost dev container.