Problem: if no git credential helper is configured, login and
submit silently fail to persist credentials.
Solution: add `has_helper()` to `git_credential.lua` that checks
`git config credential.helper`. Guard the top of `login()`,
`logout()`, and `submit()` with an early-return error. Add a
healthcheck warning when no helper is configured. Add LuaCATS
annotations to all `git_credential` functions.
Problem: credentials were stored as plaintext JSON in the cache
file, with no integration with system credential managers.
Solution: add `lua/cp/git_credential.lua` wrapping the
`git credential fill/approve/reject` protocol. Maps each platform
to its host, handles CSES token as a second entry with
`path=api-token`.
