Slice 8: configure git credentials + identity in the container

On startup the app runs git config --global to set a commit identity (GIT_USER_NAME/GIT_USER_EMAIL), safe.directory=* for host-owned mounts, and http.<GITEA_URL>.extraheader with the Gitea token so push/fetch/pull authenticate over HTTPS without an SSH key. New git.CLI.SetGlobalConfig and config fields. Verified: fetch via the app works and the identity/header are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/config/config.go

@@ -34,6 +34,9 @@ type Config struct {
 	Dev     bool   // readable console logging vs structured JSON
 	LogFile string // optional file to also append logs to
 
+	GitUserName  string // commit identity for git actions run by the app
+	GitUserEmail string // commit identity for git actions run by the app
+
 	GiteaURL    string // Gitea/Forgejo base URL (e.g. https://git.nilles.net)
 	GiteaToken  string // Gitea token (read + PR write + branch delete) — §8.4
 	GitHubToken string // optional forge token (later provider)
@@ -57,6 +60,8 @@ func Load() (Config, error) {
 		ScanFetchEnabled: envBool("SCAN_FETCH_ENABLED", false),
 		Dev:              strings.EqualFold(env("APP_ENV", "dev"), "dev"),
 		LogFile:          env("LOG_FILE", ""),
+		GitUserName:      env("GIT_USER_NAME", ""),
+		GitUserEmail:     env("GIT_USER_EMAIL", ""),
 		GiteaURL:         env("GITEA_URL", ""),
 		GiteaToken:       env("GITEA_TOKEN", ""),
 		GitHubToken:      env("GITHUB_TOKEN", ""),