fix(cnb): persist git credential helper after interactive clone

[jeff-r2026]

Problem

teamai init https://cnb.cool/<owner>/<repo> prompted for Username/Password during the post-clone push (member registration), and teamai pull failed with couldn't find remote ref main — despite the user being logged into the cnb CLI.

Root cause

cnbRepoClone used git -c credential.helper='!cnb git-credential' clone. The -c flag only applies to that single invocation — it never reaches the cloned repo's .git/config. So remote.origin.url stays credential-free, and every later git operation (push, pull) falls back to an interactive Username/Password prompt.

GitHub/TGit solve this by embedding the token in the clone URL (persisted into remote.origin.url); CNB's CI path (CNB_TOKEN) does the same. Only the interactive-login path was missing persistence.

Fix

After a successful interactive clone (no CNB_TOKEN), persist the credential helper into the cloned repo's local config:

git config --local credential.helper '!cnb git-credential'

Token-path clones (CI) already bake creds into the URL, so they skip this step.

Test plan

• Unit tests: 3 new cases covering helper persistence (interactive path), token-path skip, and not-found error. tsc --noEmit clean.
• End-to-end against a real cnb.cool account (logged-in, no CNB_TOKEN):
  • teamai init https://cnb.cool/test1122444/test --force → ✔ Member registration pushed to team repo (no prompt)
  • teamai pull → ✔ Team repo: already up to date (was fatal: couldn't find remote ref main)
  • git config --local --get credential.helper on the clone → !cnb git-credential
  • remote.origin.url stays clean (no embedded token on the interactive path)

Scope

Surgical: only cnbRepoClone changed (+23 lines); no other providers touched.

References

• Fixes the CNB path described in 给没接触过 Git 的用户：三份可粘贴接入提示词（RFC） #517 — that RFC's onboarding flow (cnb login → teamai init https://cnb.cool/...) is exactly the interactive-login path this PR makes work without a Username/Password prompt.