feat(git): reach GitHub through gh over HTTPS on agent hosts

Home Manager now owns ~/.config/gh/config.yml on agent hosts; activation moves an existing one to
config.yml.home-manager.backup.

Assisted-by: DeepSeek Harness (claude-opus-5-5)

outputs/x86_64-linux/tests/agent-profile/expected.nix

@@ -5,6 +5,8 @@ let
     qwenInstalled = true;
     devToolsFromHome = true;
     nushellSecrets = false;
+    githubSshRewrite = false;
+    ghCredentialHelper = true;
     nixLd = true;
     rootlessPodman = true;
     docker = false;

outputs/x86_64-linux/tests/agent-profile/expr.nix

@@ -27,6 +27,11 @@ lib.genAttrs hosts (
     devToolsFromHome = hasPackage "kubectl" home.home.packages;
     # ~/.secrets is synced to the desktops only; sourcing it would break nushell.
     nushellSecrets = home.modules.shell.secrets.enable;
+    # GitHub goes through the host's own `gh` login over HTTPS, not the owner's SSH key.
+    githubSshRewrite = home.programs.git.settings ? url;
+    ghCredentialHelper = lib.any (lib.hasSuffix "/bin/gh auth git-credential") (
+      home.programs.git.settings.credential."https://github.com".helper or [ ]
+    );
 
     # system module: modules/nixos/agent.nix
     nixLd = system.programs.nix-ld.enable;