[Bug] kit fetch: a host url.<ssh>.insteadOf https://github.com/ rewrite sends the anonymous kit fetch over SSH #562

kit_translate_fetch (acq.backends/kit-translate.sh) fetches public kits anonymously with -c credential.helper= -c url.https://github.com/.insteadOf=. That neutralizes a rewrite to https://github.com/, but not the common rewrite in the other direction, which many developers set globally to push over SSH:

[url "[email protected]:"]
    insteadOf = https://github.com/

With that rewrite, the pinned built-in kits are fetched over SSH, and the create fails whenever SSH auth is not available (agent locked, key needing confirmation, no key loaded):

kit-translate: failed to fetch git+https://github.com/GSA-TTS/agentic-coding-patterns.git#ref=<sha>&dir=integrations/isolation/acq-kits/zscaler-ca-certificate
kit-translate:   [email protected]: Permission denied (publickey).

Repro with acq's own flags, no network needed:

git config --global [email protected]:.insteadOf https://github.com/
git -c credential.helper= -c url.https://github.com/.insteadOf= \
  ls-remote --get-url https://github.com/GSA-TTS/agentic-coding-patterns.git
# prints [email protected]:GSA-TTS/agentic-coding-patterns.git

Observed at v4.0.1 (same -c flags in kit_translate_fetch): the repro above prints the SSH URL. Earlier, an intermittent create failure on a host with that rewrite; the identical rerun passed once the SSH agent answered.

Expected: the anonymous fetch ignores the user's URL rewrites entirely, for example by running git with GIT_CONFIG_GLOBAL=/dev/null (and GIT_CONFIG_NOSYSTEM=1) for the fetch, so a public kit is always fetched over HTTPS without credentials.

Related: #207, #208 (anonymous public kit fetch), #469 (one-directional insteadOf rationale).