v0.1.1 disabled the ambient credential helper on every remote operation,
which makes private repositories unreachable for callers that authenticate
via stored git credentials. The threat that motivated the change (an
attacker-chosen URL reaching the helper for a domain they control) applies
to RemoteBranches and RemoteHead, where the URL may be a probe; a caller
that reaches Ensure has already decided to clone that URL.

RemoteBranches and RemoteHead keep -c credential.helper=. Ensure's clone
and fetch, and EnsureCommit's unshallow, do not.