v3.0.4

git-tidy 3.0.4 — round seventeen

The worst of it wrote to your .git/config on every run. _configured_urls read
every scope while git config --replace-all writes the local file, so a
credential living in ~/.gitconfig matched nothing local and git appended a new
url= instead of replacing one. The read-back then reported failure, and the next
run did it again — one more line each time, for ever, never mentioned. Both
halves say --local now.

Work that did not happen was reported as done, in two places:

• A thin-out that emptied 100 KB and then hit a permission error returned
  applied=False, so the line said "(97.7 KB)" while the summary said nothing was
  removed and nothing freed. Its sibling _rmtree_counting had this right.
• A directory where everything is protected was called "emptied out" and
  counted as one path removed, with no bytes freed, on every run for ever — a
  .venv whose only match is a certifi/cacert.pem does exactly that. It says
  "kept whole" now, which also stops the quarantine expiry firing on a run that
  applied nothing.

YAML, both "loads on every shipped binary, fatal from a checkout":

• A control character inside a comment was never checked, because the comment
  was stripped first. PyYAML's Reader runs over the whole stream.
• ? opens a complex mapping key, which PyYAML refuses in a value position.
  The flow-collection path has guarded that for rounds; the block path had not.

Three documents described behaviour the code does not have: trash.sensitive's
comment said protected files are "lifted into quarantine" when they stay exactly
where they are; neither the README nor the man page said that clean.quarantine
changes that, or that the source and certificate exemptions do not apply to
clean.ignored_keep and clean.keep.

Also: two credentialed URLs that strip to the same thing left two identical
lines. Deduplicating them with --unset-all would have cleared the remote's
other URLs too — CodeRabbit caught that in the fix before it shipped, so it is
--fixed-value. And a detached HEAD whose trunk another worktree holds was
counted in the summary as a branch.

Full Changelog: v3.0.3...v3.0.4