fix(cloud-agent-next): enforce git credential helper config

[eshurakov]

Summary

Install the read-only Git credential helper in all Cloud Agent sandbox images and force Git to use it for setup, submodules, and LFS. Remove profile-supplied GIT_CONFIG_* overrides so the helper cannot be replaced at runtime.

Verification

• No manual UI path; this is container/runtime behavior.

Visual Changes

N/A

Reviewer Notes

• Focused tests: 117 passed in session-service.test.ts and kilo-git-credential.test.ts.
• format:check, lint, and typecheck passed.
• Full unit suite: 2,689 passed and 3 skipped. The unrelated wrapper hook test for chaining existing hooks and suppressing co-authorship timed out at its 5-second default but passed with a 15-second timeout.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/cloud-agent-next/scripts/kilo-git-credential
• services/cloud-agent-next/src/kilo-git-credential.test.ts

Previous Review Summary (commit 3bce33c)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3bce33c)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• services/cloud-agent-next/Dockerfile
• services/cloud-agent-next/Dockerfile.dev
• services/cloud-agent-next/Dockerfile.dind
• services/cloud-agent-next/scripts/kilo-git-credential
• services/cloud-agent-next/src/agent-sandbox/cloudflare/cloudflare-agent-sandbox.test.ts
• services/cloud-agent-next/src/agent-sandbox/cloudflare/cloudflare-agent-sandbox.ts
• services/cloud-agent-next/src/kilo-git-credential.test.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/shared/runtime-environment.ts

---

_{Reviewed by grok-4.6 · Input: 44.9K · Output: 5.5K · Cached: 204.7K}

_{Review guidance: REVIEW.md from base branch main}

[pandemicsyn]

lgtm, one line from the robot