workspace git push ignores configured credential profiles

[homeboy-ci]

Bug

wp datamachine-code workspace git push <worktree> --remote=origin --branch=<branch> invokes raw Git without resolving or injecting the configured GitHub credential profile. On a host without a separate Git credential helper, the command fails even though datamachine-code github status reports configured App and PAT profiles.

Error: Git command failed (exit 128): remote: Invalid username or token.
fatal: Authentication failed for https://github.com/Extra-Chill/extrachill-events.git/

Expected

Workspace push should resolve a repository-scoped credential through GitHubCredentialResolver, inject it without persisting or logging the token, and publish the managed worktree branch.

Actual

WorkspaceGitOperations::git_push() delegates directly to run_git() and relies on ambient host Git authentication. The configured profile surface and workspace Git surface therefore disagree about readiness.

Impact

A completed conventional commit in a DMC-managed worktree cannot be pushed to its existing PR branch, blocking Actions execution and review publication. Raw git push, DMC workspace git push, and SSH all fail on a correctly isolated host.

Acceptance

• Resolve credentials by repository and optional profile before fetch/push.
• Pass credentials ephemerally; never write them into remotes, Git config, argv evidence, or logs.
• Preserve current primary/worktree safety checks.
• Add a test proving a configured profile is used when ambient Git credentials are absent.