fix(security): reject credential-bearing Git remotes

[N0zoM1z0]

Description

Harden the Git remote trust boundary so secret-bearing remotes cannot reach Git, mirror metadata, corpus metadata, or invocation logs.

• centralize native Git remote validation in internal/gitremote
• reject HTTPS/file userinfo, SSH URL passwords, SCP-like password syntax, malformed transports, and ambiguous SCP-like hosts
• preserve supported HTTPS, SSH username, SCP-like SSH, file URL, and absolute local-path remotes
• keep adapter-owned error contracts while validating before runner calls and filesystem writes
• replace raw startup argv logging with a safe argument count
• add validator, adapter, app persistence, and log-redaction regressions

This aligns both acquisition paths with the architecture contract that embedded credentials are rejected before metadata is written. Previously acquire enforced most of that contract, but workspace accepted any https:// or ssh:// value and the process startup log recorded raw arguments at info level.

Testing Done

• go test ./... passes
• golangci-lint run ./... passes (CI version v2.12.0, 0 issues)
• go test -race ./internal/app ./internal/corpus passes
• go vet ./...
• go mod tidy -diff
• npm run test:npm (3/3)
• npm run test:e2e (5/5)
• govulncheck ./... with Go 1.26.5 (No vulnerabilities found)

Regression scenarios verify that credential-bearing remotes return the adapter sentinel without echoing the credential, invoke no Git runner, create no mirror/acquisition files, and persist no workspace record. Valid SSH usernames remain accepted.

Checklist

• Focused regression tests added for the relevant side-effect boundaries
• Storage invariants preserved (see CONTRIBUTING.md)
• gofmt applied to changed Go files
• No new third-party types exposed outside adapters