fix: keep the gitea token out of chezmoi init's argv and .git/config

The endpoint hands back a clone URL with the read-only token inline, and that
URL went straight onto `chezmoi init`'s command line. Two durable exposures
followed, neither of which the existing redaction touched -- it only kept the
token out of the trace line:

  - /proc/<pid>/cmdline is world-readable, so any account on the box could read
    the live token for as long as the clone ran
  - the resulting .git/config recorded the credential-bearing remote and kept
    it until the tree was deleted

Split the credential out of the URL before anything executes. The token goes to
$STATE/private-credentials at 600 in git-credential-store format; the URL that
reaches argv and .git/config is clean. The helper is passed via GIT_CONFIG_*
for the clone and then written into the clone's own config, so a later
`chezmoi update` still authenticates without the token being stored.

Verified: clone succeeds with the clean URL, .git/config contains no token, and
a subsequent fetch authenticates from the credential file alone. Suite 101/101.

dot_local/bin/executable_dotup

@@ -744,6 +744,19 @@ BWS_TOKEN=${DOTUP_BWS_TOKEN:-${XDG_CONFIG_HOME:-$HOME/.config}/bitwarden/bws-tok
 # are, days later, with nothing connecting it to the install you ran.
 PRIV_CFG=${DOTUP_PRIVATE_CFG:-${XDG_CONFIG_HOME:-$HOME/.config}/chezmoi/private.toml}
 
+# git's credential store for the private remote.
+#
+# The clone URL the endpoint hands back carries the token inline, and handing
+# that to `chezmoi init` puts a live credential in two durable places: the
+# init process's argv, which ANY account on the box can read out of
+# /proc/<pid>/cmdline for as long as the clone runs, and the resulting
+# .git/config, which keeps it until the tree is deleted. Neither is fixed by
+# not printing it -- the earlier redaction work only covered the trace line.
+#
+# Splitting the credential out of the URL fixes both: git reads the secret from
+# this file at 600, and the remote it records is clean.
+PRIV_CRED=${DOTUP_PRIVATE_CRED:-$STATE/private-credentials}
+
 cmd_private() {
 	rows=$(selected_private)
 	[ -n "$rows" ] || return 0
@@ -775,7 +788,7 @@ cmd_private() {
 	printf '  Password:      ' >&2
 	stty -echo 2>/dev/null || :; IFS= read -r P_PW || :; stty echo 2>/dev/null || :; printf '\n' >&2
 	# shellcheck disable=SC2064
-	trap 'unset P_URL P_USER P_PW P_BLOB 2>/dev/null || :' EXIT INT TERM
+	trap 'unset P_URL P_USER P_PW P_BLOB p_repo p_tok p_cred 2>/dev/null || :' EXIT INT TERM
 
 	# curl -K - reads its config, credentials included, from stdin rather than
 	# the command line. --fail matters too: without it a 401 body is parsed as
@@ -807,31 +820,65 @@ cmd_private() {
 
 	if [ "$want_repo" -eq 1 ]; then
 		if [ -n "$p_repo" ]; then
-			# NOT `run`. It echoes its whole argv to stderr, and this argv ends
-			# in https://user:TOKEN@host/... -- which would put a live git
-			# credential into terminal scrollback, any `dotup 2>log`, and any
-			# agent or CI transcript capturing the run. Trace a redacted form
-			# and execute quietly.
+			# Split the credential out of the URL before anything executes.
+			# p_cred is the bare scheme://user:token@host that
+			# git-credential-store wants -- host only, no path. p_clean is the
+			# same URL with the userinfo removed. A remote with no userinfo
+			# (ssh, or an unauthenticated https URL) leaves p_cred empty and
+			# p_clean identical to what arrived, so it is used unchanged.
+			p_cred=$(printf '%s\n' "$p_repo" | sed -n 's|^\(https\{0,1\}://[^@/]*@[^/]*\).*|\1|p')
+			p_clean=$(printf '%s\n' "$p_repo" | sed -e 's|^\(https\{0,1\}://\)[^@/]*@|\1|')
+			if [ -n "$p_cred" ]; then
+				mkdir -p "$(dirname "$PRIV_CRED")"
+				( umask 077; printf '%s\n' "$p_cred" > "$PRIV_CRED" )
+				chmod 600 "$PRIV_CRED"
+				# GIT_CONFIG_* rather than `git -c`: the helper string names
+				# the credential file, and while that path is not itself a
+				# secret, argv is the wrong channel for anything about it.
+				# The value is single-quoted because git runs a helper
+				# containing spaces through a shell -- an unquoted $HOME with
+				# a space in it would split into two arguments.
+				GIT_CONFIG_COUNT=1
+				GIT_CONFIG_KEY_0=credential.helper
+				GIT_CONFIG_VALUE_0="store --file='$PRIV_CRED'"
+				export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
+			fi
+
+			# NOT `run`. It echoes its whole argv to stderr, and even a clean
+			# URL is worth tracing deliberately rather than by accident.
+			# redact_url stays on the trace as a second line of defence: if
+			# the split above ever fails to match, the credential still does
+			# not reach terminal scrollback, `dotup 2>log`, or an agent
+			# transcript capturing the run.
 			mkdir -p "$(dirname "$PRIV_CFG")"
 			if [ "$DRYRUN" -eq 1 ]; then
 				printf '  + chezmoi init --apply --source %s -c %s %s\n' \
-					"$PRIV_SRC" "$PRIV_CFG" "$(redact_url "$p_repo")"
+					"$PRIV_SRC" "$PRIV_CFG" "$(redact_url "$p_clean")"
 			else
 				printf '%s  + chezmoi init --apply --source %s -c %s %s%s\n' \
-					"$DIM" "$PRIV_SRC" "$PRIV_CFG" "$(redact_url "$p_repo")" "$R" >&2
-				chezmoi init --apply --source "$PRIV_SRC" -c "$PRIV_CFG" "$p_repo" \
+					"$DIM" "$PRIV_SRC" "$PRIV_CFG" "$(redact_url "$p_clean")" "$R" >&2
+				chezmoi init --apply --source "$PRIV_SRC" -c "$PRIV_CFG" "$p_clean" \
 					|| err "private repo init failed"
 			fi
 
+			# The exported vars above only cover this process. Record the same
+			# helper in the clone's own config so a later `chezmoi update`
+			# still authenticates -- the token stays in PRIV_CRED, and
+			# .git/config learns only where to look for it.
+			if [ -n "$p_cred" ] && [ -d "$PRIV_SRC/.git" ]; then
+				git -C "$PRIV_SRC" config credential.helper \
+					"store --file='$PRIV_CRED'" 2>/dev/null || :
+			fi
+			unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
+
 			# The clone lands with the caller's umask, which on a stock Ubuntu
 			# is 022 -- world-readable. This tree holds ssh config, accepted
-			# keys and machine identity, and its .git/config stores the
-			# credential-bearing remote URL in plain text. On a shared or
-			# multi-user box that is readable by anyone with an account.
+			# keys and machine identity. On a shared or multi-user box that is
+			# readable by anyone with an account.
 			[ ! -d "$PRIV_SRC" ] || chmod -R go-rwx "$PRIV_SRC" 2>/dev/null || :
 		else err "the blob carried no PRIVATE_REPO_URL"; fi
 	fi
-	unset p_repo
+	unset p_repo p_cred p_clean
 	trap - EXIT INT TERM
 }