Add ENTIRE_CHECKPOINT_TOKEN for checkpoint push/fetch auth

[pjbgf]

Inject a bearer token into git push/fetch operations for checkpoint branches when the ENTIRE_CHECKPOINT_TOKEN env var is set. The token is passed via GIT_CONFIG_COUNT env vars (not CLI args) to avoid exposing it in /proc/cmdline. Only HTTPS remotes are supported; SSH remotes trigger a warning that the token is ignored.

---

Note

Medium Risk
Moderate risk because it changes how git network commands are constructed and modifies authentication behavior via environment injection, which could affect checkpoint syncing and credential handling. Scope is limited to checkpoint/metadata git operations and is covered by new unit and integration-style tests.

Overview
Adds ENTIRE_CHECKPOINT_TOKEN support for checkpoint git operations by introducing strategy.CheckpointGitCommand, which injects a bearer token as http.extraHeader via GIT_CONFIG_* env vars for HTTPS remotes (and warns/ignores tokens for SSH or unknown targets).

Updates checkpoint-related git fetch/push call sites (including metadata fetches and checkpoint-remote bootstrap fetch) to use this wrapper, while preserving non-interactive behavior by explicitly appending GIT_TERMINAL_PROMPT=0 where needed.

Adds comprehensive tests validating protocol detection, env var filtering/injection, SSH warning behavior, and that real git requests to an HTTPS test server actually include the Authorization header.

^{Written by Cursor Bugbot for commit ea1a7da. Configure here.}

[Copilot]

Pull request overview

Adds optional bearer-token authentication for checkpoint-related git push/git fetch operations when ENTIRE_CHECKPOINT_TOKEN is set, by injecting an http.extraHeader Authorization header via GIT_CONFIG_COUNT env vars (avoiding CLI args exposure).

Changes:

• Introduces strategy.CheckpointGitCommand to build git CLI commands with conditional token injection for HTTPS remotes (and warn/ignore for SSH).
• Switches checkpoint push/fetch call sites to use CheckpointGitCommand.
• Adds unit/integration-style tests validating protocol resolution, env injection, and that git actually sends the Authorization header over HTTPS.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cmd/entire/cli/strategy/push_common.go	Uses CheckpointGitCommand for checkpoint branch push/fetch.
cmd/entire/cli/strategy/checkpoint_token.go	New helper for protocol detection and token injection via GIT_CONFIG_* env vars.
cmd/entire/cli/strategy/checkpoint_token_test.go	Tests for protocol resolution, env injection, stderr warning, and real HTTPS header behavior.
cmd/entire/cli/strategy/checkpoint_remote.go	Uses CheckpointGitCommand for metadata-branch fetch-by-URL with GIT_TERMINAL_PROMPT=0.
cmd/entire/cli/git_operations.go	Routes several origin fetch operations through strategy.CheckpointGitCommand.

[nodo]

LGTM 🚀