feat(helpers4-common): automatic git-config self-heal on every attach

[baxyz]

Summary

First of two PRs (split from #74 — see below for why). This one is helpers4-common only.

The root cause

A client's own automatic behavior — VS Code copying ~/.gitconfig, SSH agent forwarding — happens outside any devcontainer Feature's control, verbatim, with no awareness that a path baked into the host's config might not resolve inside this particular container:

signingkey = ~/.ssh/id_baxyz_craft_ed25519.pub   # never existed in the container
[credential "https://gist.github.com"]
    helper = !/snap/gh/751/gh auth git-credential  # gh lives at /usr/local/bin/gh here

helpers4-common (1.0.1 → 1.1.0)

New postAttachCommand: git-config-self-heal.sh — automatic for every consumer, since every feature already depends on helpers4-common:

• credential.helper (incl. per-URL scopes), gpg.program, gpg.ssh.program, core.editor: a shell-out to an absolute path that doesn't resolve here gets rewritten to the bare command name once a same-named binary is found on $PATH — bare, not a fresh absolute path, so it never goes stale again even if the tool moves on a future rebuild.
• user.signingkey (gpg.format=ssh only): tries a same-basename file under ~/.ssh/~/.gnupg first, then recovers the public key live from a forwarded ssh-agent matched against user.email (ssh-add -L only, never touches private key material). On GitHub Codespaces, which doesn't forward a local ssh-agent at all — confirmed via GitHub's own community discussion, an official response states this explicitly — warns with a pointer to Codespaces secrets instead of silently doing nothing.

Also adds h4_detect_cloud_env to common.sh (Codespaces/Gitpod/DevPod/WSL detection).

A real bug found and fixed while testing: a multi-valued credential.helper (a blank "reset" entry followed by a real one — legitimate, common) makes plain git config <key> <value> refuse outright (exit 5). The first implementation swallowed that failure via 2>/dev/null || true while still reporting success. Fixed by targeting the one broken value via --replace-all <key> <new> <old-as-anchored-regex> and actually checking the exit status.

Why split from the original combined PR (#74)

#74 also included a dotfiles-sync refactor that depends on h4_detect_cloud_env. While testing, discovered that devcontainer features test --features dotfiles-sync . resolves dependsOn: ghcr.io/helpers4/devcontainer/helpers4-common:1 from the published GHCR registry, not this repo's local src/ tree — confirmed by inspecting the actual staged build content (missing git-config-self-heal.sh entirely) and the published manifest (docker manifest inspect ghcr.io/helpers4/devcontainer/helpers4-common:1 → still 1.0.1). Only the feature passed directly via --features gets fresh local content; a transitive dependency's CI test will fail if it needs behavior that isn't published yet — not a bug in the consumer, a limitation of testing interdependent changes within one PR. Landing helpers4-common here first, then dotfiles-sync in a follow-up once this is merged and released, sidesteps it entirely. Documented in AGENTS.md for next time.

#74 will be closed in favor of this PR + the dotfiles-sync follow-up.

Test plan

• bash -n / jq empty on all changed scripts and manifests
• Real Docker end-to-end: reproduced the exact reported .gitconfig (stale gh path + missing SSH signing key), ran the self-heal, confirmed both fixed; confirmed idempotence (clean second run); confirmed both warning paths (nothing resolvable locally, and the GitHub Codespaces-specific message)
• test/helpers4-common/test.sh updated with functional assertions for the self-heal, passing in a real container
• Verified the Codespaces-secrets doc URL referenced in the warning message resolves to a real, current GitHub docs page

🤖 Generated with Claude Code

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🧾 Conventional Commits	passing
✅	🔖 Version Bump	passing
✅	🧪 Feature Tests	passing
✅	🐚 ShellCheck	passing

---

_{🤖 Generated by @helpers4 CI • 2026-09-06}