v3.0.5

git-tidy 3.0.5 — round eighteen

The three worst findings were all in the duplicate-URL tidying added in 3.0.4,
which CodeRabbit had already caught once before it shipped. It is gone.

git fetches from the first url = of a remote, so their order is
load-bearing — and --replace-all collapses every line its pattern matches into
one, which moves the survivor. Two values that stripped to the same thing were
enough to silently repoint a remote at its mirror, with the report saying only
"2 credentials taken out of remote URLs". A failed --add after a successful
--unset-all left the remote with no URL at all, reported as success, exit 0.
And with git before 2.30 the unset was a no-op, so it added a third copy: the
very shape 3.0.4 was released to remove.

A remote with more than one value for a setting is now reported and left alone.
One value is safe to rewrite in place; several are the user's to sort out, and
saying so beats breaking a remote to tidy a duplicate line.

Also:

• keep: [Don't Touch/*, build] was refused here and read fine by PyYAML: an
  apostrophe opened a quoted run that never closed. _strip_comment has had the
  "a quote only opens where a value can begin" rule for rounds; _split_flow did
  not, so the two disagreed with each other. Loads from a checkout, fails on
  every shipped binary.
• A partial thin-out kept its future-tense prediction as its detail, so --json
  showed "empty out, keeping id_rsa" beside "applied": true. Only the applied
  line had been copied from _rmtree_counting, not the detail line.
• git gc ran without asking under --ask, even in a repository where every
  fetch and switch had just been declined, and never appeared in the report
  either way. It asks now, and says what it did.
• The man page never mentioned clean.quarantine, and named only
  clean.ignored_keep where the code also means clean.keep.

Full Changelog: v3.0.4...v3.0.5