[REMOTE-1370] Phase 2a: taskGitCredentials schema, query, and AIClient

[jasonkeung]

Description

First half of Phase 2 of REMOTE-1370. Adds the GraphQL plumbing for `taskGitCredentials` so the driver can call it in the next PR.

Changes:

• Add `taskGitCredentials` types to `schema.graphql` and add to the `clientQueries` allowlist in `client-schema.ts`
• New `task_git_credentials.rs` cynic query file, following the `task_secrets` pattern
• Add `GitCredential` struct and `get_task_git_credentials` to `AIClient` trait + `ServerApi` implementation

No behaviour change — nothing calls `get_task_git_credentials` yet; that's in the follow-on PR.

schema.graphql approach: `yarn generate -p staging` was run to verify the new types, but the output was not committed wholesale because the current staging server also has other unrelated schema changes (removed `freeAvailableModels`, new `VOYAGE_4_512` EmbeddingConfig variant, etc.) that are out of scope and would break existing Rust bindings. Instead, only the `taskGitCredentials` types were cherry-picked — the field names, nullability, and doc comments were verified to be identical to what the server generates.

Warp-server staging is deployed with the new query.

Followed by: #10153.

Linked Issue

Linear: REMOTE-1370

Testing

• `cargo build -p warp` clean
• `cargo fmt` and `cargo clippy` clean

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

Conversation: https://staging.warp.dev/conversation/e16dc3e2-8e2f-4499-8c9b-59b200e17c50

Co-Authored-By: Oz oz-agent@warp.dev

[oz-for-oss]

@jasonkeung

I'm starting a first review of this pull request.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

Adds the client-side GraphQL schema/query plumbing and AIClient method for fetching task git credentials. The implementation follows the existing taskSecrets pattern and no caller behavior changes in this PR.

Concerns

• No blocking correctness concerns found in the changed lines.
• The merge dependency on the server-side Phase 1 rollout remains an operational gate outside this code review.

Security

• One non-blocking hygiene issue: avoid deriving Debug on the app-level credential type so tokens are not accidentally emitted by debug logging.

Verdict

Found: 0 critical, 0 important, 1 suggestions

Approve with nits

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz