feat: add GITLAB_TOKEN/GITLAB_USERNAME authentication via temporary GIT_ASKPASS helper

When both GITLAB_TOKEN and GITLAB_USERNAME environment variables are set, a temporary shell script is created and passed as GIT_ASKPASS to all git subprocess invocations. The script responds with the username when git prompts for "Username..." and with the token for any other prompt (password). GIT_TERMINAL_PROMPT=0 is also set to prevent interactive fallback.

The helper script is created inside a context manager that ensures cleanup after each git command. When the env vars are absent, behaviour is unchanged (no-op overlay).

Includes 9 new tests covering:

• Empty overlay when env vars are missing/partial
• Script creation, permissions, and cleanup
• Correct username/token responses for different prompts
• Integration with _run() both with and without env vars