Use credential helper for source selector auth

[shiny-code-bot]

Summary

• use an environment-backed Git credential helper for private source selector resolution
• keep source tokens out of process arguments while avoiding runner extraheader issues
• cover the credential-helper git environment in unit tests

Tests

• uv run python -m unittest tests.test_runtime.RuntimeCommandTests.test_resolve_source_repository_ref_to_git_sha_uses_credential_helper tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_uses_dedicated_source_token_env tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_supports_ci_source_token_env tests.test_runtime.RuntimeCommandTests.test_resolve_artifact_runtime_source_refs_prefers_runtime_github_token
• uv run ruff format --check odoo_devkit/local_runtime.py tests/test_runtime.py
• uv run ruff check odoo_devkit/local_runtime.py tests/test_runtime.py