No test exercises a real git remote

[timflannagan]

No test in this repo executes a real git command, so the credential, pin, and clone paths are covered only by pure functions and mocks.

CloneAndCopyContext              0.0%
gitutil.Source.Fetch            18.2%
plugins/source.resolveGit       11.8%
plugins/source.classifyGitErr    0.0%

SkillController.reconcile reports 96%, but by construction rather than depth. Its own test comment notes "Every case is chosen to fail or succeed before any network call", and it builds gitutil.NewSource(nil), so no credential hook is ever invoked.

The gap has already shipped a defect. authenticate redacted only the password component, so a token-only credential (a GitHub PAT supplied with no username) survived into the ls-remote error that the Skill and Plugin controllers persist to resource status. The existing redaction assertions only ever built the username+password shape, where the masking works.

Hermetic coverage is possible today without a cluster, because ParseGitURL matches the /-/ marker before the host check:

http://127.0.0.1:38211/org/repo             -> unsupported git host
http://127.0.0.1:38211/org/repo/-/tree/main -> http://127.0.0.1:38211/org/repo.git

A seeded bare repo served from httptest with basic auth would reach both credential shapes, CloneAndCopyContext, and Fetch.

Relying on /-/ works around the host allowlist rather than fixing it, and a transport change does not help: ParseGitURL is pure URL handling on both entry paths, so the allowlist survives a go-git refactor unchanged. Note also that it is not a host restriction in practice, since the same marker admits a loopback address while a GitHub Enterprise Server host is refused.

Refs: #627