feat(git-credential): per-agent git_credentials_read_only override

[chaodu-agent]

Summary

Follow-up to #56. Adds a per-agent git_credentials_read_only override on [[mcp.agents]] entries. The global [mcp] git_credentials_read_only remains the fleet default; a per-agent value wins over it in either direction. Omitted = inherit (backward compatible — existing configs behave identically).

Problem

#56's flag is broker-global: either every agent gets read-only git credentials or every agent gets push-capable ones. Real fleets are mixed — e.g. one deployer agent that pushes, and reviewer/triage agents that must clone private repos but never push. The only workaround was running a second octobroker instance with a different config.

Design

• McpAgentConfig::git_credentials_read_only: Option<bool> (#[serde(default)] → None = inherit global).
• Effective mode in /git-credential: agent.git_credentials_read_only.unwrap_or(mcp.git_credentials_read_only).
• Some(false) deliberately re-enables push over a global read-only default — that's the recommended posture (read-only fleet default + explicit push exceptions). Both values are operator-set config in the same file; an agent can never choose its own mode.
• Token cache isolation from feat(git-credential): add git_credentials_read_only flag #56 carries over unchanged: read and write tokens live under distinct cache purposes, so agents with different modes never share credentials even for the same repo.
• Issuance log line now records the minted mode (contents=read|write).

Changes

• src/config.rs — new Option<bool> field on McpAgentConfig, documented.
• src/git_credential.rs — effective-mode resolution + mode in the issuance log.
• README.md / config.example.toml — per-agent override documented with the mixed-fleet example.
• Tests — test_per_agent_read_only_overrides_global_write (global write, agent pinned read-only → mints contents: read) and test_per_agent_write_overrides_global_read_only (global read-only, agent pinned push-capable → mints contents: write). Inheritance (None) is covered by the existing feat(git-credential): add git_credentials_read_only flag #56 tests.

Testing

• cargo clippy --all-targets -- -D warnings (clean)
• cargo test — 135 passed; 0 failed
• cargo test git_credential — 12 passed, incl. both new override tests

Self-review addendum (commit 8c6b92c)

Three independent review tracks (security/correctness, test quality, docs/compat) were run against the first commit. Docs/compat came back clean; two 🟡 findings were fixed:

1. Audit gap — the effective mode (contents: read|write) was only in the tracing log, not the durable audit JSONL. record_git_credential_result now takes a mode field, recorded on success and both failure paths (resolved from operator config before owner verification), so the audit trail alone can answer "did agent X hold push capability at time T". Endpoint tests assert the field.
2. Missing TOML roundtrip test — added test_agent_git_credentials_read_only_toml_roundtrip guarding the tri-state Option<bool> (omitted → None, explicit true/false → pinned) against future serde-attribute refactors.

Re-verified: clippy -D warnings clean, 136 tests passed (0 failed).