Reuse native macOS Git credentials

AGENTS.md

@@ -11,13 +11,17 @@ secure-secret-storage orchestration. Git remotes are typed HTTPS or optional
 SSH endpoints; reject local, helper, executable, and unknown transports before
 entering Git transport code. Builds without the `ssh` feature must still parse
 SSH endpoints and return a typed unsupported-transport error before connection
-or repository mutation.
+or repository mutation. When a password-store repository contains Git remotes,
+those names and URLs are authoritative; use application configuration only as
+the fallback for a repository without remotes.
 
 The SSH feature must keep its algorithm allowlist, strict known-host checking,
 single configured identity, bounded channel/diagnostic limits, and ambiguous
-push outcome rules in `crates/storage`. Do not add OpenSSH configuration,
-proxy commands, password or keyboard-interactive authentication, host-key
-bypasses, or frontend transport policy.
+push outcome rules in `crates/storage`. The in-process SSH configuration reader
+may honor only the connection directives `Host`, `HostName`, `User`, `Port`,
+and `IdentityFile`. Do not add `Include`, `Match`, proxy commands, password or
+keyboard-interactive authentication, host-key bypasses, or frontend transport
+policy.
 
 The CLI, Ratatui, Iced, Swift, SwiftUI, AutoFill, and watchOS code may collect
 input, invoke the Rust API, and present Rust-provided state. They must not