feat(git): reach GitHub through gh over HTTPS on agent hosts

Home Manager now owns ~/.config/gh/config.yml on agent hosts; activation moves an existing one to
config.yml.home-manager.backup.

Assisted-by: DeepSeek Harness (claude-opus-5-5)

home/base/core/git.nix

@@ -1,10 +1,18 @@
 {
+  config,
   lib,
   pkgs,
   myvars,
   ...
 }:
 {
+  options.modules.git.githubSsh.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    description = "Rewrite https://github.com/ryan4yin remotes to SSH with the owner's key.";
+  };
+
+  config = {
     # `programs.git` will generate the config file: ~/.config/git/config
     # to make git use this config file, `~/.gitconfig` should not exist!
     #
@@ -48,7 +56,7 @@
         log.date = "iso"; # use iso format for date
 
         # replace https with ssh
-      url = {
+        url = lib.mkIf config.modules.git.githubSsh.enable {
           "ssh://git@github.com/ryan4yin" = {
             insteadOf = "https://github.com/ryan4yin";
           };
@@ -97,4 +105,5 @@
 
     # Git terminal UI (written in go).
     programs.lazygit.enable = true;
+  };
 }

home/linux/tui.nix

@@ -13,4 +13,8 @@
 
   # ~/.secrets is synced to the desktops only.
   modules.shell.secrets.enable = false;
+
+  # Agent hosts use their own GitHub account, logged in with `gh`, over HTTPS.
+  modules.git.githubSsh.enable = false;
+  programs.gh.enable = true;
 }

hosts/README.md

@@ -25,7 +25,8 @@ directory.
 - **desktop**: Niri session and GUI apps on top of the full TUI stack.
 - **agent**: headless, with the full TUI stack from Home Manager (shell, editors, dev toolchains,
   cloud CLIs, AI agents with their rules and skills), and nix-ld, rootless Podman and linger from
-  the system. Computer use (Xvfb + i3, VNC) is part of the profile but off by default.
+  the system. Computer use (Xvfb + i3, VNC) is part of the profile but off by default. Git reaches
+  GitHub over HTTPS with the host's own `gh` login, not the owner's SSH key.
 - **server**: system services only, no Home Manager.
 
 The `agent` hosts differ only in:

outputs/x86_64-linux/tests/agent-profile/expected.nix

@@ -5,6 +5,8 @@ let
     qwenInstalled = true;
     devToolsFromHome = true;
     nushellSecrets = false;
+    githubSshRewrite = false;
+    ghCredentialHelper = true;
     nixLd = true;
     rootlessPodman = true;
     docker = false;

outputs/x86_64-linux/tests/agent-profile/expr.nix

@@ -27,6 +27,11 @@ lib.genAttrs hosts (
     devToolsFromHome = hasPackage "kubectl" home.home.packages;
     # ~/.secrets is synced to the desktops only; sourcing it would break nushell.
     nushellSecrets = home.modules.shell.secrets.enable;
+    # GitHub goes through the host's own `gh` login over HTTPS, not the owner's SSH key.
+    githubSshRewrite = home.programs.git.settings ? url;
+    ghCredentialHelper = lib.any (lib.hasSuffix "/bin/gh auth git-credential") (
+      home.programs.git.settings.credential."https://github.com".helper or [ ]
+    );
 
     # system module: modules/nixos/agent.nix
     nixLd = system.programs.nix-ld.enable;