git.nix: commit the gh credential helper the baked dev image already carries

[alycda]

Symptom. After a container restart, git push over https fails with fatal: could not read Username for 'https://github.com': No such device or address until gh auth setup-git is re-run by hand.

Cause. The baked dev image's home-manager generation includes gh as git's credential helper (credential."https://github.com".helper = !…gh auth git-credential is visible in the store-managed ~/.config/git/config) — but that config exists nowhere in the repo, not in git.nix and not in /opt/dotfiles. It came from an uncommitted local working copy at image-build time — the same drift pattern as the CLAUDE-arm64.md wording fixed in #61. Any activation from actual repo source regenerates the git config without the helper. (The trigger in practice: a locally-activated test generation lived in the container's ephemeral overlay /nix; after restart the config symlink dangled and re-activation restored repo-sourced config, helperless.)

Fix. Commit the missing piece. Idiomatic form (HM's gitCredentialHelper defaults on; requires programs.git.enable, already set):

programs.gh = {
  enable = true;
  settings.git_protocol = "https";
};

Notes: gh is currently in lib/core-packages.nix; programs.gh also installs it, so drop it there or tolerate the duplicate. If adopting the whole programs.gh module is unwanted, the raw equivalent in git.nix settings:

credential = {
  "https://github.com".helper = [ "" "!${pkgs.gh}/bin/gh auth git-credential" ];
  "https://gist.github.com".helper = [ "" "!${pkgs.gh}/bin/gh auth git-credential" ];
};

(the leading "" resets inherited helpers).

🤖 Generated with Claude Code