Keep credentials out of reprs; count only live ssh-agents in tests

A failing CI test printed a test key through SSHKey's default repr. Push
credentials, AgentConfig's tokens and MatrixConfig's token are now
excluded from their reprs, so no failure or log line can print them. In
CI's container killed ssh-agents linger as zombies, so the tests count
only live ones.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/git.py

@@ -18,7 +18,7 @@ Pull requests are opened from the agent's own host with its Gitea API token
 """
 
 import shlex
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 
 from nisse_dev.execution import HostUnavailable, SSHHost
@@ -67,14 +67,15 @@ class HTTPSToken:
     """A push-only account's token, for HTTPS remotes (D4)."""
 
     username: str
-    token: str
+    # Never in a repr: a failing test or a log line would print it.
+    token: str = field(repr=False)
 
 
 @dataclass(frozen=True)
 class SSHKey:
     """A deploy key's private half, for SSH remotes (D4)."""
 
-    private_key: str
+    private_key: str = field(repr=False)
 
 
 PushCredential = HTTPSToken | SSHKey