hive-core's git ignores the host's credential helpers, so a meta fetch never waits on an interactive one

hive-core's .gitconfig now resets credential.helper (globally and for the
forge URL) before adding hive-forge. git runs every matching helper, system
config first, so a host-level `oauth` helper blocked `nix flake update`'s
git ls-remote of agent-configs forever.

On deploy: the boot sweep's meta_lock completes and rebuilds run.

nix/host-modules/hive-c0re/default.nix

@@ -48,10 +48,18 @@ let
   # render). The `[credential]` stanza points git at the `hive-forge` helper
   # below, scoped to the forge host, for any `git+http` fetch from it as the
   # forge `core` user. hive-c0re's own forge reads use `forge::reader_token()` instead.
+  #
+  # git runs every matching `credential.helper`, system config first, so a
+  # host helper (e.g. `oauth`, which waits on a browser) would run ahead of
+  # ours. An empty `helper =` resets the list; it comes first at both the
+  # global and the forge level so no /etc/gitconfig helper survives.
   safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
     [safe]
     directory = *
+    [credential]
+    helper =
     [credential "http://${config.services.hyperhive.swarm.forge.domain}"]
+    helper =
     helper = hive-forge
     username = core
     [http]