feat(adk): a secret-free bash environment with the turn's git identity #290

Problem

The bash tool runs a model-written command on an allowlisted environment (commandEnvNames in go/adk/pkg/tools/shell.go, carried as fix(adk): run bash tool commands on an allowlisted environment, #303): PATH, HOME, USER, LOGNAME, LANG, LC_*, TERM, TZ, TMPDIR and the CA-bundle variables. The model keys, the controller token and every KAGENT_* variable stay in the runtime (kagent-dev#3002; the open kagent-dev#3014 strips by name instead). The allowlist admits neither GH_TOKEN nor a git identity, so the Harness images' gh (#288) runs gh --version but every authenticated call fails on the kagent Harness. A coding agent working as the person needs two things in that environment and nothing else secret:

• An inert placeholder token for the provider's CLI. gh refuses every API call without GH_TOKEN; in a Session with caller credentials (feat(egress): caller credentials per Session through Substrate's actor-JWT exchange #297) the egress gateway replaces the header gh sends with the person's token, so the placeholder only has to exist. Nothing sets it today, the allowlist withholds it, and a strip by name (TOKEN) would remove it.
• git's author and committer identity. Without one git commit fails ("Please tell me who you are") or records the sandbox's user, so nothing the agent commits is attributed to the person. The runtime knows the person of the turn: the identity the a2a gateway forwards as x-kagent-user, which the Go ADK already sets on every model call.

Proposed solution

The carried allowlist gains, per turn, GIT_AUTHOR_NAME, GIT_AUTHOR_EMAIL, GIT_COMMITTER_NAME and GIT_COMMITTER_EMAIL from the turn's user identity (the email; the name the forwarded identity carries, otherwise the email), and GH_TOKEN set to the translator's inert placeholder value (kagent-credential-injected) in a turn whose dispatch names a workspace directory (#296's working-directory header), so the CLI runs and the gateway does the authentication. The allowlist admits the inert placeholder only: a real token in the runtime's environment never reaches the command. A session without claims (unsecure mode, an agent's propagated caller id) gets no identity variables, so git's own error stands rather than a stand-in author. Built on kagent-dev#3014: the allow-list is proposed there as the shape that keeps a placeholder, and carried on the fork line until upstream settles it.

Acceptance criteria

• env through the bash tool shows no model key, controller token or KAGENT_* variable; in a Session with a workspace it shows GH_TOKEN=kagent-credential-injected, in one without it shows no GH_TOKEN (unit test; fork e2e on the kagent Harness)
• git commit through the bash tool in a turn sent by alice@example.com carries author and committer alice@example.com; the next turn, sent by bob@example.com, commits as bob (unit test on the executor's per-turn environment)
• gh api user through the bash tool reaches the git host fixture with the exchanged token, never the placeholder (fork e2e on test(e2e): snapshotted workspace volume and grant signer fixtures #293's fixture and feat(egress): caller credentials per Session through Substrate's actor-JWT exchange #297's fake broker)
• FORK.md row; the upstream exit is the allow-list proposed on fix(adk): strip secret env vars from the Go bash tool kagent-dev/kagent#3014's thread