feat(vmtest-harness): propagate the host GITHUB_TOKEN into the Tart guest for pattern (b)

[mac-duetto]

Closes #4924

vmtest run branch cloned the repo anonymously, subject to GitHub's anonymous
rate limit on an egress IP shared by the host and every concurrent guest. It now
propagates the host's GITHUB_TOKEN into the guest as a preemptive
http.https://github.com/.extraheader.

The two findings that shaped the design

credential.helper store silently does nothing here. Git only consults a
helper after a 401, and github.com serves a public repo with 200 — no
challenge, no helper call. The obvious mechanism looks like it works while
delivering zero rate-limit relief. extraheader is sent preemptively on every
github.com request instead.

The pinned tahoe-base image ships a ~/.gitconfig wired to Git Credential
Manager, which is interactive. Without git's documented empty-value reset
(git config --global --replace-all credential.helper '') before the header
is wired in, a rejected credential makes guest git ls-remote hang indefinitely
in a headless VM rather than fail. This branch confirmed the reset at runtime by
booting a --keep VM and reading credential.helper back as the empty string.

Leak surface

The token crosses to the guest on stdin only, via vm_exec_stdin — the same
channel the existing toolchain.tsv write uses. vm_exec/vm_exec_raw are
disqualified because their argument becomes tart exec … /bin/sh -c "<string>"
in host argv. It is never a config key (print_banner echoes every CONF_KEYS
value to stdout on every run, including --dry-run), never in
$VMTEST_GUEST_ENV (composed once and prefixed onto every guest command for the
run's full duration), and never in repo_url (logged verbatim on success,
tail -40'd on failure). Only the boolean propagate_github_token is a config
key; the include path is the only thing that enters a command string.

The 0600 include file is created under umask 077 rather than
write-then-chmod, which would leave a window at a looser mode.

Gating

The pattern-(b) test is the first executable statement of
provision_github_token, above every branch that can die. Patterns (a) and
(c) never contact github.com, so an expired or revoked host token cannot break
vmtest run local or vmtest run released — proven by a real run, not by
inspection. A malformed boolean fails at preflight_config before any VM is
cloned; that check is deliberately kept out of the shared conf_load(), so a
typo'd override can never break vmtest clean.

An absent GITHUB_TOKEN is not an error — the run proceeds anonymously exactly
as before.

Verification (real VMs, not --dry-run)

Run	Exit	Wall	Evidence
pattern (b), valid token	0	827s	in-guest git ls-remote succeeded with the preemptive header; cloned at b98fb77c; 13/13 binaries, 5/5 daemons
pattern (a), invalid token	0	687s	zero FAIL of any kind; gate returned before any credential work
pattern (b), invalid token	40	59s	credential step 1.977s; terminal prompts disabled; the 60s watchdog never fired — git exited on its own, so no hang
pattern (b), --keep	0	1013s	retention warning fires; booted the kept VM and confirmed mode 0600, one include.path line, 0 newlines in the header, credential.helper empty
pattern (c), --keep, token still set	—	~1m	teardown branch reached, zero credential lines — the pattern gate, not an absent token

Leak audit — 0 hits in every sink, for both the raw token and its base64
Authorization form: all run logs, $VMTEST_RUNDIR (snapshotted mid-run before
teardown deletes it), 642 per-second ps -Aww samples across the valid-token
run, and git grep over the branch. A positive control returned 2 hits, so the
grep was not vacuous.

bash -n clean. shellcheck 0.11.0: 17 findings on origin/main, 17 after —
diff identical, zero new. The harness's tart-literal invariant is unchanged
(the lib/verify.sh hit is pre-existing on origin/main).

Adversarial review verdict: APPROVE, all ten stated invariants confirmed by
static trace, zero CRITICAL/HIGH. Its three findings are applied in c2bdea60.

Operational caveat

--keep leaves the VM on disk in stopped state with the credential intact.
Base64 is encoding, not encryption. The remedy is vmtest clean --include-kept;
if a kept VM has been shared or copied, revoke the token — deleting the VM
afterward does not undo prior exposure. This is now warned at runtime in the
--keep teardown, not only in the README.

Known gap, deliberately not fixed

git config --global --add include.path is not idempotent — re-provisioning the
same guest without teardown would append a duplicate line. Unreachable today
because every run gets a fresh guest clone; verified as exactly one line on the
kept VM. If guest reuse is ever introduced, switch to --replace-all.

Out of scope, surfaced by this work

• Guest provisioning has no retry on the mise rust download; a transient DNS
  failure cost one 57s run here and reports FAIL[40] … DO NOT REPAIR, which
  reads identically to real base-image drift.
• lib/verify.sh:1385 contains the literal tart in a comment, a pre-existing
  breach of the harness's own "tart only in lib/vm.sh" invariant.
• lib/provision.sh gains the harness's first shellcheck disable directive
  (one line, with its reason), suppressing an SC2034 on a global whose consumer
  lives in vmtest. Three globals of the same shape already sit unannotated in
  the baseline.

🤖🤖🤖 Generated with trusty-mpm — https://github.com/bobmatnyc/trusty-tools