feat(expressions): add repoCredentials() expression function

[jsbroks]

Description

Closes #6549

Adds a repoCredentials() expression function that resolves repository credentials by repo URL and credential type (git, helm, image), returning them as a map[string]string. It is a thin entry point into the same credentials database used by built-in promotion steps like git-clone.

Unlike secret(), which returns the raw Data of a Secret selected by name, repoCredentials() returns the resolved credentials — not the raw contents of the underlying Secret. This means it transparently handles credential schemes that yield narrowly-scoped, short-lived credentials (e.g. a GitHub App installation token minted from an app ID + private key, or a cloud provider's ambient / Pod-identity credentials), which is exactly what custom and generic steps (e.g. http calling a provider API) need but previously had no way to obtain.

Behavior

• Signature: repoCredentials(repoURL, type) where type is one of git,
  helm, or image. The type is required because credentials are indexed by
  type and the same URL may resolve differently per type (URL normalization also
  differs per type).
• When credentials are found, it always returns the fixed set of keys
  username, password, sshPrivateKey (empty string when unset), so
  expression authors can rely on a predictable shape regardless of provider.
  API keys / personal access tokens / minted tokens are surfaced via password.
• When no credentials are found, it returns an empty map (mirroring secret()).

Implementation

• New RepoCredentials() option and getRepoCredentials() implementation in
  pkg/expressions/function, wired into DataOperations() (which now takes a
  credentials.Database).
• StepEvaluator now carries the credentials database and threads it through
  Vars / ShouldSkip / Config; LocalOrchestrator passes the DB it already
  receives.
• Caching mirrors secret() (per-step cache, distinct RepoCredentials
  key prefix).

Reviewer notes

• Contexts without a credentials database — Stage verification argument
  evaluation, the Argo CD selector, and the indexer — register the function but
  return a clear "not available in this context" error if it is invoked. Fully
  wiring a credentials DB into the Stage controller was intentionally left out to
  limit blast radius; happy to follow up if we want it there too.
• Custom / pod-based steps are the primary intended consumer (per the
  discussion on expression function for repo credential lookup by url #6549). This PR wires the function into the OSS StepEvaluator
  config-evaluation path; the Enterprise pod-based executor's config-evaluation
  path should be confirmed to flow through the same wiring.
• Security consideration for discussion: because the function materializes a
  (possibly minted) token into the expression environment, that token can flow
  into a step's outputs, logs, or committed files. Worth deciding whether any
  guardrails are wanted here.

Checklist

Eligibility

• Linked to an existing issue with no blocking labels.
• Changes documentation only.
• Changes ten lines or fewer.

Quality

• Adds or updates corresponding tests.
• Adds or updates corresponding documentation.

AI Use Disclosure

This PR was written:

• By a human without AI assistance.
• By a human with AI assistance. A human has reviewed every line prior to opening the PR.
• By an AI with human supervision. A human has reviewed every line prior to opening the PR.
• Entirely by an AI. No human has reviewed this prior to opening the PR.

Sign-Off

All commits:

• Are signed off by their author (git commit -s) (required)
• Are cryptographically signed (git commit -S) (encouraged)

[netlify]

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	6ecfff2
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/6a4fa499bc6db70008ce3905
😎 Deploy Preview	https://deploy-preview-6558.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 85.07463% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.81%. Comparing base (de4b5e3) to head (6ecfff2).
⚠️ Report is 18 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/expressions/function/functions.go	84.90%	8 Missing ⚠️
cmd/controlplane/controller.go	0.00%	1 Missing ⚠️
pkg/controller/stages/regular_stages.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6558      +/-   ##
==========================================
+ Coverage   58.68%   58.81%   +0.12%     
==========================================
  Files         506      506              
  Lines       42846    42985     +139     
==========================================
+ Hits        25146    25280     +134     
- Misses      16157    16166       +9     
+ Partials     1543     1539       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[krancour]

This might not be the optimal behavior. It's common to use optional chaining and nil-coalescing in expressions, so returning nil is probably a more useful signal when no credentials are found.

[krancour]

See https://github.com/akuity/kargo/pull/6558/changes#r3661696941