Use git credential helpers for fetch operations instead of raw URLs

[jcleira]

Description

Replace any exec.Command("git", "fetch-pack", rawURL) or equivalent raw-URL git fetch calls in Partio's CLI with git fetch origin <ref> so that git credential helpers (HTTPS) and SSH agents are used for authentication. Optionally adopt the go-git library with a credential-resolving auth method to avoid shelling out entirely. Add debug-level logging when fetch fallback paths are triggered rather than silently discarding errors.

Why

Raw URL fetches bypass credential helpers, causing failures on private HTTPS repositories and breaking setups that rely on credential managers, SSH agents, or token-based auth. Using the normal git credential chain ensures Partio works reliably across all repo configurations.

Source

• Origin: Review Feedback entireio/cli#721 and Replace git CLI fetch with go-git using new credential helper entireio/cli#719
• Detected from: entireio-cli-pulls

Target Repos

• cli

Acceptance Criteria

• Fetching checkpoint blobs from private HTTPS repos succeeds using configured git credential helpers
• SSH repos authenticate via SSH agent without requiring raw URL credentials
• Debug-level log entry is emitted when a fetch falls back to an alternative method
• No regression in fetch behavior for public repos or repos with existing credential setup
• Tests cover HTTPS and SSH credential resolution paths

Context Hints

• cli/internal/
• cli/cmd/

---

Comment /minion build or add the minion-approved label to begin implementation.