Avoid exposing Git credentials in subprocess command-line arguments

### Description

Cachew currently passes repository-scoped authorization credentials to Git using command-line configuration:

```text
git -c credential.helper= ...
```

The credential is embedded as a literal in the helper definition, which exposes it in Git's process arguments. Command-line arguments may be visible through process inspection tools, `/proc//cmdline`, diagnostic tooling, or process telemetry.

PR #321 also identified that credentials are embedded in the helper command, but addressed token refresh during long-running subprocesses. It was closed in favor of #322, which addressed token lifetime and LFS timeouts without removing credentials from process arguments.

### Proposed change

Pass credential-bearing Git configuration through Git's environment-based configuration mechanism instead:

```text
GIT_CONFIG_COUNT=
GIT_CONFIG_KEY_=http..extraHeader
GIT_CONFIG_VALUE_=Authorization:
```

The implementation should:

- Preserve existing `GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_*`, and `GIT_CONFIG_VALUE_*` entries.
- Append the credential configuration at the next available index.
- Reject malformed, negative, or overflowing `GIT_CONFIG_COUNT` values.
- Continue validating the authorization value and repository URL scope.
- Restrict this change to credential-bearing configuration; ordinary non-sensitive Git configuration can remain in command-line arguments.
- Ensure credentials do not appear in the generated Git subprocess arguments.

### Security impact

This reduces accidental credential disclosure through process listings and command-line capture. The credential remains in the child process environment, as required by Git, so access to process environments should still be restricted appropriately.

Locate the code that builds Git subprocess arguments and handles credential-bearing configuration, then trace its authorization-value and repository-URL validation. Check how the child environment is assembled, including existing GIT_CONFIG_* entries and malformed counts. Done means credentials are absent from subprocess arguments while configuration preservation, validation, and scoped authorization behavior remain covered by tests.

Written by the indexing model from the issue text.