feat(forge): resolve an optional forge read credential (STATE-WP-0084-T02/T03)

Nine repositories are invisible to derivation because central may not read
them. This adds the consuming half of the credential lane MASON-WP-0003 built.

The cluster has no agent injector and no secrets-store CSI driver, so the pod
authenticates to OpenBao with a projected ServiceAccount token (audience
`openbao`, not the API server) and reads the KV path itself. `forgeRead.*`
carries coordinates only; no credential is a chart value, an image layer, or a
Kubernetes Secret.

The credential reaches git through GIT_CONFIG_* setting http.extraHeader, not
through `-c` and not through userinfo in the clone URL — both of those put the
token in the process listing. It is redacted from ForgeDeriveError, which is
logged, stored in reset outcomes, and returned over the API.

Absent stays a supported state: with no credential, or with OpenBao
unreachable, resolution returns None and public derivation runs unchanged.
Raising would turn "nine repositories are unreadable" into "the pass failed",
which is what T01 exists to prevent.

Chart default is disabled. 717 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

api/services/forge_projection.py

@@ -13,6 +13,7 @@ what makes the reset in `T03` verifiable: you can always ask what the projection
 from __future__ import annotations
 
 import os
+import base64
 import re
 import subprocess
 import tempfile
@@ -163,16 +164,50 @@ class DerivedProjection:
         }
 
 
-def _run_git(*args: str, cwd: str | None = None, timeout: float = 120.0) -> str:
+from api.services.forge_credential import forge_read_token  # noqa: F401
+
+# Kept as module attributes so callers and tests that reached for them here
+# still resolve after the sources moved to `forge_credential`.
+FORGE_TOKEN_ENV = "FORGE_READ_TOKEN"
+FORGE_TOKEN_FILE_ENV = "FORGE_READ_TOKEN_FILE"
+
+
+def _credential_env(token: str | None) -> dict[str, str]:
+    """Git config carrying the credential, passed by environment not argv.
+
+    `-c http.extraHeader=...` would place the token in the process command line,
+    where it is readable by anything that can run `ps` and lands in any log that
+    records invocations. GIT_CONFIG_* achieves the same configuration without
+    that exposure.
+    """
+    if not token:
+        return {}
+    header = base64.b64encode(f"x-access-token:{token}".encode()).decode()
+    return {
+        "GIT_CONFIG_COUNT": "1",
+        "GIT_CONFIG_KEY_0": "http.extraHeader",
+        "GIT_CONFIG_VALUE_0": f"Authorization: Basic {header}",
+    }
+
+
+def _run_git(
+    *args: str, cwd: str | None = None, timeout: float = 120.0, token: str | None = None
+) -> str:
     # Without this a clone of a private repository blocks on a username prompt
     # instead of failing, and an unattended derivation pass hangs rather than
     # reporting. Failing fast is what makes the unreadable case observable.
     env = {**os.environ, "GIT_TERMINAL_PROMPT": "0", "GIT_ASKPASS": "", "GCM_INTERACTIVE": "never"}
+    env.update(_credential_env(token))
     proc = subprocess.run(
         ["git", *args], cwd=cwd, capture_output=True, text=True, timeout=timeout, env=env
     )
     if proc.returncode != 0:
-        raise ForgeDeriveError((proc.stderr or proc.stdout).strip()[:400])
+        detail = (proc.stderr or proc.stdout).strip()[:400]
+        if token:
+            # Never let a credential reach an exception that is logged, stored
+            # in a reset outcome, or returned over the API.
+            detail = detail.replace(token, "***")
+        raise ForgeDeriveError(detail)
     return proc.stdout.strip()
 
 
@@ -269,12 +304,13 @@ def derive_from_forge(
     someone's local state instead (ADR-012 context).
     """
     url = f"{forge_base.rstrip('/')}/{repo_slug}.git"
+    token = forge_read_token()
     with tempfile.TemporaryDirectory(prefix=f"forge-{repo_slug}-") as tmp:
         args = ["clone", "--depth", "1", "--quiet"]
         if ref:
             args += ["--branch", ref]
         try:
-            _run_git(*args, url, tmp)
+            _run_git(*args, url, tmp, token=token)
         except subprocess.TimeoutExpired as exc:
             raise ForgeDeriveError(f"clone timed out for {repo_slug}") from exc
         except ForgeDeriveError as exc: