fix(github): keep the clone token out of git's command line

[julianam-w]

Summary

• Bug: the GitHub token used to clone private repos was written into the clone URL (https://x-access-token:<token>@github.com/...). When a clone failed, Python's CalledProcessError printed the full command, so the token appeared in plain text in the traceback and in any log or terminal that captured it.
• Fix: a new shallow_clone() in rag/github.py passes the token as a git http.extraheader through GIT_CONFIG_COUNT / GIT_CONFIG_KEY_n / GIT_CONFIG_VALUE_n environment variables. The token no longer appears in the command line, git's output, a Python error, or the temporary clone's .git/config.
• authed_clone_url() is removed. All three clone sites use shallow_clone(): ingest.py --repo and the two clones in sync.py.

Linear / spec

• No Linear issue. Security bugfix, so no spec.

Test plan

• git reads the header from the environment (git config --get http.https://github.com/.extraheader returns the expected value)
• A failed clone against GitHub with a dummy token: neither the token nor its base64 form appears in the CalledProcessError message or traceback, and GitHub rejecting the dummy token shows the header was sent
• A public repo clones with no token
• No header is added when there's no token or the URL isn't https://github.com/
• /code-review --fix: no findings
• ruff: no new findings
• After merge: the Railway sync clones a private repo with the existing GITHUB_TOKEN

Risk / rollback

• Needs git ≥ 2.31 for GIT_CONFIG_COUNT. The Docker image's Debian git meets this.
• If a machine's global git config already sets its own extra header for github.com, git sends two Authorization headers and GitHub may reject the clone. That's unlikely, and Railway has no such config.
• Any token that already appeared in a failed-clone traceback should be treated as exposed and rotated. The fix doesn't protect a token that has already leaked.
• Rollback: revert the commit.

Checklist

• CI green
• Docs updated if applicable (no docs referenced the removed helper)
• Spec status updated if implementing/changing a spec (n/a)
• Spec change-log squashed to a single merge-dated entry; resolved DV-XXX / OQ-XXX rows deleted (not annotated) (n/a)

🤖 Generated with Claude Code