feat(§3.3): Implement Gitea PAT auth for guest-side git clone

Credential Manager target 'GiteaPAT' (default) read on host, passed
securely to guest WinRM session. Token never appears in argv, URL, or logs.

Guest auth flow (§1.5 compliant):
1. Host reads PAT via Get-StoredCredential -Target GiteaPAT
2. Username + password passed as ArgumentList to Invoke-Command
3. Guest writes temp .git-credentials file (https://user:token@host)
4. git clone uses: -c 'credential.helper=store --file <tmp>'
5. finally{} deletes credentials file regardless of clone success/fail

Setup (one-time on host):
  New-StoredCredential -Target 'GiteaPAT' -UserName '<user>' `
      -Password '<pat>' -Persist LocalMachine

Invoke-CIJob.ps1: added -GiteaCredentialTarget param (default: 'GiteaPAT'),
passed through to Invoke-RemoteBuild when -UseGitClone is set.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/Invoke-CIJob.ps1

@@ -100,6 +100,11 @@ param(
     # Prerequisite: Git for Windows installed in template.
     [switch] $UseGitClone,
 
+    # Credential Manager target for Gitea PAT used by -UseGitClone (private repos).
+    # Store with: New-StoredCredential -Target 'GiteaPAT' -UserName '<user>' -Password '<pat>' -Persist LocalMachine
+    # Ignored when -UseGitClone is not set.
+    [string] $GiteaCredentialTarget = 'GiteaPAT',
+
     [string] $TemplatePath = $env:GITEA_CI_TEMPLATE_PATH,
 
     [string] $SnapshotName = $(if ($env:GITEA_CI_SNAPSHOT_NAME) { $env:GITEA_CI_SNAPSHOT_NAME } else { 'BaseClean' }),
@@ -375,9 +380,9 @@ try {
     }
     if ($UseGitClone) {
         # §3.3: Clone in VM — pass URL/branch/commit instead of HostSourceDir
-        # PAT will be read from Credential Manager inside Invoke-RemoteBuild (§1.5)
-        $remoteBuildParams['CloneUrl']    = $RepoUrl
-        $remoteBuildParams['CloneBranch'] = $Branch
+        $remoteBuildParams['CloneUrl']              = $RepoUrl
+        $remoteBuildParams['CloneBranch']           = $Branch
+        $remoteBuildParams['GiteaCredentialTarget'] = $GiteaCredentialTarget
         if ($Commit -ne '') { $remoteBuildParams['CloneCommit'] = $Commit }
         if ($Submodules)    { $remoteBuildParams['CloneSubmodules'] = $true }
     }