Add GUI git-askpass so credential prompts work without a TTY

Installs /usr/local/bin/git-askpass (uses zenity or qarma) and sets
core.askPass in /etc/gitconfig. Git now pops a GUI dialog for username/
password instead of trying to open /dev/tty, which fails in headless
contexts (scripts, Claude Code terminal).

Adds zenity to live desktop package lists for both niri and cinnamon profiles.
Propagated to: both live ISO builders and the installer postinstall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/profiles/mainline-niri/packages.live-desktop.list

@@ -91,6 +91,7 @@ python3
 upower
 power-profiles-daemon
 wl-clipboard
+zenity
 
 # --- XDG portals ---
 xdg-desktop-portal

config/profiles/stable-cinnamon/packages.live-desktop.list

@@ -15,6 +15,7 @@ sudo
 bash
 bash-completion
 git
+zenity
 curl
 wget
 vim

installer/lib/postinstall.sh

@@ -88,10 +88,23 @@ EOF
     fi
     chmod 440 "$TARGET/etc/sudoers.d/10-wheel"
 
-    # git: use file-based credential store so push/pull never tries to open /dev/tty
+    # git: GUI askpass so prompts work without a controlling terminal
+    install -d -m 0755 "$TARGET/usr/local/bin"
+    cat > "$TARGET/usr/local/bin/git-askpass" <<'EOF'
+#!/bin/sh
+for cmd in zenity qarma; do
+    command -v "$cmd" >/dev/null 2>&1 || continue
+    case "$1" in
+        *[Uu]sername*) exec "$cmd" --entry   --title="Git Credentials" --text="$1" ;;
+        *)             exec "$cmd" --password --title="Git Credentials" --text="$1" ;;
+    esac
+done
+printf '%s' "$1" >&2; read -r answer; printf '%s\n' "$answer"
+EOF
+    chmod 0755 "$TARGET/usr/local/bin/git-askpass"
     cat > "$TARGET/etc/gitconfig" <<'EOF'
-[credential]
+[core]
-	helper = store
+	askPass = /usr/local/bin/git-askpass
 EOF
 
     ok "user '$USERNAME' created and added to: $USER_GROUPS"

iso/build-live-iso.sh

@@ -653,10 +653,23 @@ EOF
 install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/nixpkgs"
 echo '{ allowUnfree = true; }' > "$INCLUDE_DIR/etc/skel/.config/nixpkgs/config.nix"
 
-# git: use file-based credential store so push/pull never tries to open /dev/tty
+# git: GUI askpass so prompts work without a controlling terminal
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/git-askpass" <<'EOF'
+#!/bin/sh
+for cmd in zenity qarma; do
+    command -v "$cmd" >/dev/null 2>&1 || continue
+    case "$1" in
+        *[Uu]sername*) exec "$cmd" --entry   --title="Git Credentials" --text="$1" ;;
+        *)             exec "$cmd" --password --title="Git Credentials" --text="$1" ;;
+    esac
+done
+printf '%s' "$1" >&2; read -r answer; printf '%s\n' "$answer"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/git-askpass"
 cat > "$INCLUDE_DIR/etc/gitconfig" <<'EOF'
-[credential]
+[core]
-	helper = store
+	askPass = /usr/local/bin/git-askpass
 EOF
 
 # ── 3g) Skel: .bash_profile sources .bashrc only (no first-login autorun) ──

iso/build-niri-live-iso.sh

@@ -264,10 +264,23 @@ EOF
 install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/nixpkgs"
 echo '{ allowUnfree = true; }' > "$INCLUDE_DIR/etc/skel/.config/nixpkgs/config.nix"
 
-# git: use file-based credential store so push/pull never tries to open /dev/tty
+# git: GUI askpass so prompts work without a controlling terminal
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/git-askpass" <<'EOF'
+#!/bin/sh
+for cmd in zenity qarma; do
+    command -v "$cmd" >/dev/null 2>&1 || continue
+    case "$1" in
+        *[Uu]sername*) exec "$cmd" --entry   --title="Git Credentials" --text="$1" ;;
+        *)             exec "$cmd" --password --title="Git Credentials" --text="$1" ;;
+    esac
+done
+printf '%s' "$1" >&2; read -r answer; printf '%s\n' "$answer"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/git-askpass"
 cat > "$INCLUDE_DIR/etc/gitconfig" <<'EOF'
-[credential]
+[core]
-	helper = store
+	askPass = /usr/local/bin/git-askpass
 EOF
 
 # ── 3e) niri config.kdl in /etc/skel ───────────────────────────────────