bootstrap.sh: store gitea cred helper in /etc/gitconfig, not /root/.gitconfig

The systemd sync timer runs git without HOME set, so git config --global
(which writes /root/.gitconfig) is invisible to the timer's process — the
timer fails with 'could not read Username' silently. Switching to
--system writes to /etc/gitconfig which is HOME-agnostic.

Migration for already-bootstrapped hosts captured in agent-enrollment.md
troubleshooting.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -63,8 +63,10 @@ configure_gitea_creds() {
     host=$(echo "$REPO_HTTPS" | sed -E 's|^https?://([^/]+).*|\1|')
     printf '%s://%s:%s@%s\n' "$proto" "$GITEA_USER" "$GITEA_TOKEN" "$host" > "$creds_file"
     chmod 600 "$creds_file"
-    # Point git at this store globally for root (so future pulls work too).
-    git config --global credential.helper "store --file=$creds_file"
+    # Point git at this store system-wide (/etc/gitconfig) so the systemd
+    # sync timer's git — which runs as root without HOME set — finds it.
+    # --global writes to /root/.gitconfig which the timer doesn't read.
+    git config --system credential.helper "store --file=$creds_file"
     echo "[bootstrap] wrote gitea credentials to $creds_file"
 }