Fix git push using wrong credentials from actions/checkout

[james-in-a-box]

Fix gateway push using GITHUB_TOKEN instead of bot App token

When the egg action runs in GitHub Actions, actions/checkout@v4
persists the GITHUB_TOKEN as an http.extraheader in .git/config.
This extraheader takes precedence over the GIT_ASKPASS credential
helper that the gateway sets up with the bot App token. Since the
GITHUB_TOKEN lacks workflows scope, pushes that include
.github/workflows/ files are rejected.

This caused the bot to be unable to push workflow files in PR #146,
even though the GitHub App has the correct permissions.

Two fixes applied (defense in depth):

1. Gateway (gateway.py): Clear http.extraheader via
   -c http.extraheader= when running git push, ensuring only the
   gateway's GIT_ASKPASS credential helper is used.

2. Workflow (on-mention.yml): Add persist-credentials: false
   to both checkout steps so actions/checkout doesn't write the
   GITHUB_TOKEN to .git/config in the first place.

Issue: none
Related: #146

Test plan:

• Trigger the bot on a PR and verify it can push workflow file changes
• Verify normal (non-workflow) pushes still work
• Verify the gateway uses the bot App token (check auth_mode in logs)

Authored-by: egg