[ZPascal]

Summary

• Refactor start.sh: no more executing input as commands, quoted cd, push args built with "$@", remote URL resolved once (fixes directory values containing spaces).
• Add tests/unit.sh (fake git, asserts on flags) and tests/e2e.sh (real git against a local bare repo via insteadOf), plus a Tests workflow with shellcheck.
• Token is passed via a host-scoped http.extraheader in GIT_CONFIG_* env instead of being embedded in the remote URL (no longer in process args or git error output).
• push_only_tags now never pushes the branch, also without force_with_lease (matches the documented behavior).
• start.js exits with 1 instead of -1 (255).

Behavior changes to review

• push_only_tags: true without force_with_lease previously also pushed HEAD:<branch>.
• Auth header is sent in addition to any header actions/checkout persisted; not reset.

Test plan

• bash tests/unit.sh (38 pass)
• bash tests/e2e.sh (17 pass)
• shellcheck in CI (not run locally)