fix(ci): separate git credentials from --git-repo URL to fix tea pr create

tea pr create matches the remote URL against the configured login URL to
auto-detect owner/repo. Embedding credentials in the URL (user:token@host)
breaks that match and produces "path segment [0] is empty". Store creds
via git credential helper instead and pass a clean URL to uh-cli.

Also adds set -x to the PR step for shell-level tracing in CI logs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/gitops-update.yaml

@@ -71,10 +71,15 @@ jobs:
           echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
           echo "Resolved image: ${IMAGE}"
 
-      - name: Configure git identity
+      - name: Configure git identity and credentials
         run: |
           git config --global user.name  "uh-cli bot"
           git config --global user.email "bot@hrajfrisbee.cz"
+          # Store credentials separately so the --git-repo URL stays clean.
+          # Tea matches the login URL against the remote URL; embedded credentials
+          # break that matching and cause "path segment [0] is empty" on pr create.
+          git config --global credential.helper store
+          echo "https://kacerr:${GITEA_TOKEN}@gitea.home.hrajfrisbee.cz" >> ~/.git-credentials
 
       - name: Authenticate tea
         run: |
@@ -85,10 +90,11 @@ jobs:
 
       - name: Open image-update PR (or dry run)
         run: |
+          set -x
           uh-cli -v gitops deployment update \
             --deployment-name fuj-management \
             --deployment-namespace fuj \
             --set-image "${{ steps.resolve.outputs.image }}" \
-            --git-repo "https://kacerr:${GITEA_TOKEN}@gitea.home.hrajfrisbee.cz/kacerr/home-kubernetes" \
+            --git-repo "https://gitea.home.hrajfrisbee.cz/kacerr/home-kubernetes" \
             --git-path gitops/home-kubernetes \
             ${{ (github.event_name == 'workflow_dispatch' && inputs.dry_run == 'true') && '--dry-run' || '' }}