test: add benign macOS Puppet Git boundary canary

[rpgsec]

Purpose

Authorized HackerOne security validation for a Firefox CI macOS privilege boundary.

The added one-shot task verifies whether task-controlled Git configuration is honored when the existing passwordless Puppet command invokes Git as root. The credential helper prints only its action and numeric identity.

Safety controls

• Draft PR only. This is not intended to merge.
• Requires the expected cltbld task user, sudo rule, checkout path, and public Ronin origin.
• Uses fixed fake credentials so GitHub returns 401.
• Requires the Puppet checkout HEAD to remain unchanged.
• Requires the root script to stop before git reset and before Puppet starts.
• Does not read secrets, worker configuration, or later-task data.
• Deletes its task-owned temporary home on exit.

Expected decisive output:

H1_ROOT_GIT_CREDENTIAL_HELPER action=get uid=0
uid=0(root)
H1_CHECKOUT_UNCHANGED=true
H1_ROOT_HELPER_SEEN=true
RESULT: TASK-CONTROLLED HOME TO ROOT GIT HELPER EXECUTION CONFIRMED
SAFETY: Git stopped on the deliberate 401 before reset or Puppet apply

[firefoxci-taskcluster]

No Taskcluster jobs started for this pull request

The allowPullRequests configuration for this repository (in .taskcluster.yml on the default branch) does not allow starting tasks for this pull request.

[github-actions]

(Automated Close) Please do not file pull requests here, see https://firefox-source-docs.mozilla.org/contributing/how_to_submit_a_patch.html