feat(doctor,why,use): detect local .git/config shadowing a binding

[OfirHaim1]

What

A repo's local .git/config wins over the includeIf gitswitch writes (git precedence: local > global). So when user.name / user.email / user.signingkey / core.sshCommand are set in a repo's .git/config, they silently defeat a gitswitch binding — commits and pushes go out under the local identity, while gitswitch why happily reports the binding is active (the effective email matches only by coincidence).

This is the #1 adoption trap: anyone who set per-repo identities the old way (git config user.email …) before adopting gitswitch hits it, and the tool gives them false confidence instead of a warning.

gitswitch keeps control at the identity layer (still includeIf, which is its whole value — one binding covers a tree, including repos cloned later) but now makes the conflict visible and resolvable.

Changes

• git: LocalOverrides(dir) detects identity keys set in a repo's local .git/config; UnsetLocal(dir, key) clears them.
• why: replaces the misleading (matches binding ✓) with ⚠ binding shadowed by local .git/config, lists the offending keys, and shows the take-over command.
• doctor: folds the same detection into the final summary, so it can no longer print ✓ all layers agree while a binding is silently shadowed.
• use: after binding, detects shadowing local config and prompts (y/N) to remove it so the binding actually takes effect. On decline or no-TTY it keeps the keys and prints the exact manual git config --local --unset commands; the closing message no longer promises automatic switching when overrides remain.
• tests: cover LocalOverrides + UnsetLocal (detect, no-op on clean repo, clear, idempotent re-unset).

Before / after — why in a shadowed repo

# before  (false confidence)
✓ active identity: private
  user.email:        ofir474@gmail.com   (matches binding ✓)

# after  (the truth)
⚠ binding shadowed by local .git/config
  user.email:        ofir474@gmail.com   (from local .git/config, not the binding)
  ...
⚠ this repo's local .git/config overrides the binding
  set locally, so they win over the includeIf above:
      user.name, user.email, core.sshCommand
  gitswitch isn't really in control here. Take over with:
  gitswitch use private <dir>   (it will offer to remove the local overrides)

Design note (non-goal)

gitswitch does not take over auth/credential management (gh account, HTTPS credential helper) — that's machine-wide, gh/keychain-owned state. This PR is detection + opt-in cleanup of git config shadowing only, consistent with why/doctor's "tell me when my identity layers disagree" mission.

Test plan

• go build ./..., go vet ./... — clean
• go test ./internal/... — git package tests pass (incl. new ones)
• Ran why / doctor / use against a real shadowed repo: shadowing is detected; use prompts and (on confirm) clears it; a non-shadowed repo shows no warning (no false positives).