[Sites] Add a host-owned push_source tool so repository credentials never cross agent transcripts

What Codex variant are you using?

Codex desktop app on Windows with the Sites connector.

What feature would you like to see?

Please add a host-owned Sites push_source operation that pushes the exact local source state without returning a repository credential to the model-facing tool surface.

The intended flow is:

1. Codex/Sites validates the requested site and expected source commit.
2. Sites mints and consumes the repository-scoped, short-lived credential entirely inside the trusted host boundary.
3. The host pushes the exact source state to the bound Sites repository.
4. The tool returns only non-sensitive evidence such as the pushed commit, branch, archive/content digest, and an ALREADY_SATISFIED result when that exact commit is already present.

The credential should never appear in model context, task/session transcripts, nested tool arguments or results, telemetry, replay data, process command lines, terminal output, temporary Git configuration/files, diagnostics, or user-visible UI.

Suggested acceptance coverage:

• Run an end-to-end test with a unique harmless marker in place of a credential.
• Verify the marker is absent from retained transcripts, tool metadata, telemetry/diagnostics, process listings, terminal output, environment dumps, temporary files, and Git configuration.
• Verify the pushed commit exactly matches the caller's expected commit.
• Verify retrying the same commit returns ALREADY_SATISFIED without minting or exposing another credential.
• Fail closed before Git starts if the source identity, destination, or expected commit cannot be verified.

This would close the current gap where Sites can mint a short-lived repository write credential but the model-facing execution surface has no documented sensitive-value channel for delivering it to Git safely.

Additional information

Related secret-boundary report: #36079

Git already supports the downstream Git-side pattern through --config-env=http.extraHeader=<ENV_VAR>, which avoids placing transient configuration directly on the command line: https://git-scm.com/docs/git#Documentation/git.txt---config-envltnamegtltenvvargt

A host-owned Sites operation is preferable here because the credential can remain entirely inside the Sites/Codex boundary instead of crossing chat, shell, tool arguments, or files.

Start by tracing the existing Sites credential-minting flow and the model-facing execution surface; no specific source files or tests are named. Use Git's --config-env pattern as the downstream reference, then add end-to-end coverage for credential absence across transcripts, telemetry, processes, files, and output. Done means exact-commit verification, safe ALREADY_SATISFIED retries, and fail-closed validation before Git starts.