fix(acq): make kit fetch non-interactive; never prompt for git creds (#207) - #209

…207)

acq run … could drop into an interactive git credential prompt
(Username for 'https://github.com') and hang/fail when fetching a hybrid/v1
kit from the (public) patterns repo — even when the user was authed via gh.
Root cause: gh auth authenticates the gh CLI, not plain git, and kit-translate
ran a bare git fetch with no GIT_TERMINAL_PROMPT=0 and no credential isolation,
so a global git credential helper or url.*.insteadOf rewrite forced auth on a
public clone.

kit_translate_fetch now fetches NON-INTERACTIVELY:
- GIT_TERMINAL_PROMPT=0 + GIT_ASKPASS=/bin/echo + GCM_INTERACTIVE=never on every
  git call, so it can never hang on a prompt.
- Attempt 1 (anonymous): neutralizes any inherited credential.helper and the
  github.com insteadOf rewrite, so a public fetch just works.
- Attempt 2 (authed retry, still prompt-disabled): system git config intact for
  legitimately private / enterprise-mirror sources.
- Actionable error on genuine failure (gh auth setup-git; check insteadOf).
- Hardening: reject a hostile dir= (absolute path / '..' / illegal chars) before
  any git call (defense-in-depth, parity with kit_spec_files).

sbx.sh: the passthrough-on-fetch-failure warning is now loud + actionable for
git+http* refs (#208 item 1) instead of a terse one-liner.

docs/KNOWN_FAILURE_MODES.md: new entry #25 (the prompt symptom + gh auth
setup-git fix + the prevention note).

test-acq: +5 assertions (prompt disabled, anon credential-neutralizing flags,
traversal dir rejected + no git call). 153/153 pass. shellcheck clean.

Closes #207. Addresses #208 (item 1 fallback loudness + KNOWN_FAILURE_MODES doc).

Co-authored-by: OpenCode Agent <[email protected]>

…-it 5.0.2)

Markdown Quality CI gates on npm audit --audit-level=high and has been red on
main since two new high-severity advisories landed against the pinned linter
deps: js-yaml GHSA-52cp-r559-cp3m (YAML merge-key quadratic CPU, affects
4.0.0-4.2.0) and linkify-it GHSA-v245-v573-v5vm (mailto: quadratic DoS). Bump
the overrides to js-yaml 4.3.0 (patched 4.x, still compatible with
markdownlint-cli2 0.22.1) and pin linkify-it 5.0.2; regenerate lockfile.
npm audit --audit-level=high: 0 vulnerabilities.

Co-authored-by: OpenCode Agent <[email protected]>

The kit fetch printed a harmless-but-noisy error on every kit
('.git/info/sparse-checkout: No such file or directory') because 'git init'
does not always create .git/info/ (platform-dependent — reproduced on macOS
where it is absent right after init). Add 'mkdir -p .git/info' before the
sparse-checkout redirect. Reported live during 'acq run' (3x, one per kit);
non-fatal (fetch fell back) but should not emit errors.

Co-authored-by: OpenCode Agent <[email protected]>