fix(auth): reset other credential helpers in auth setup-git

setup-git appended tea's helper after the helpers Git already had, such
as osxkeychain from the system configuration. Those helpers answered
first, and after a push Git asked every helper to store tea's token, so
it ended up in the macOS Keychain where auth logout never removes it.
setup-git now writes an empty helper for the instance before tea's own,
as tea already does for its per-operation Git credentials. Add
--keep-helpers for the previous behavior.

Signed-off-by: bircni <bircni@icloud.com>

internal/git/credentials.go

@@ -57,9 +57,12 @@ func CredentialArguments(instance, executable, user, configDir string) ([]string
 type CredentialSetup struct {
 	Directory, Instance, Executable, User, ConfigDirectory string
 	Local                                                  bool
+	// KeepHelpers adds tea's helper after other helpers instead of resetting them for the instance.
+	KeepHelpers bool
 }
 
-// SetupCredentials adds a scoped helper without removing other credential helpers.
+// SetupCredentials installs a helper scoped to the instance. Unless KeepHelpers is set, an empty
+// helper first resets other helpers for the instance, so they neither answer for tea nor store its token.
 func SetupCredentials(ctx context.Context, runner Runner, options CredentialSetup) error {
 	normalized, err := settings.NormalizeHost(options.Instance)
 	if err != nil {
@@ -100,8 +103,17 @@ func SetupCredentials(ctx context.Context, runner Runner, options CredentialSetu
 			return err
 		}
 	}
-	if slices.Contains(helpers, helper) {
-		return nil
+	if options.KeepHelpers {
+		if slices.Contains(helpers, helper) {
+			return nil
+		}
+	} else {
+		if slices.Equal(helpers, []string{"", helper}) {
+			return nil
+		}
+		if _, err := runner.Output(ctx, cwd, false, "config", scope, "--replace-all", prefix+"helper", ""); err != nil {
+			return err
+		}
 	}
 	_, err = runner.Output(ctx, cwd, false, "config", scope, "--add", prefix+"helper", helper)
 	return err