Decide Hub shared/scm adoption + git-credential isolation, reconciled with OpenShell

**Why this is `ready-for-human`:** this is a coupled design decision with
cross-ADR judgment calls, not a delegatable implementation task. Deferred
from #142 (ADR 0016 + ADR 0017) to post-dev-preview.

## Decide, as one coherent design

1. **Hub `shared/scm` adoption** (the original scope of this issue) —
replace the harness's in-process go-git backend with
`tackle2-hub/shared/scm.Git`, so there's one git backend across Hub and
the harness instead of two. This removes `StripCredentials` but
introduces an on-disk credential-helper file (`scmHome/.git-credentials`)
for the run's duration. See ADR 0016 (draft on #142).

2. **Git-credential isolation from goose** — the on-disk credential file
breaks ADR 0007's isolation claim: goose runs as a subprocess sharing
the harness UID, so file-mode bits don't keep it out. ADR 0017 (draft on
#142) proposes moving goose into its own native-sidecar container under a
distinct UID. This would be the operator's first-ever `securityContext`
usage, a second pod container, and a second image user.

3. **Reconcile with OpenShell (ADR 0004, Accepted).** OpenShell's privacy
router already "strips sandbox-supplied credentials and injects real
backend credentials," and its supervisor "handles credential isolation."
Before we commit to the goose-sidecar isolation model, decide whether
OpenShell simply owns this problem — otherwise we risk building isolation
machinery that OpenShell makes redundant.

## Why deferred

- (1) and (2) are a package: adopting `shared/scm` is what puts the
credential on disk, which is the only reason (2) exists. They must be
decided together.
- Both are bigger than the dev-preview (v0.11.0) sprint and don't block it —
the current go-git + credential-strip path works today.
- The cleanest resolution may be "OpenShell owns credential isolation," so
this should be decided alongside the OpenShell integration, not ahead of
it.

## Inputs

- PR #142 — full analysis and alternatives (setuid helper, `CAP_SETUID`,
`GIT_ASKPASS`, native sidecar, scoped credentials). Preserve; do not lose.
- ADRs: 0004 (OpenShell), 0007 (harness thin runner), 0008 (harness owns pod
ACP port), 0016 (draft), 0017 (draft).

## Outcome

An accepted ADR (or a supersession of 0007) covering all three points, with
implementation issues to follow.