auth: surface context cancellation from credential Lookup

Previously every failure from GitCredentialCommand was swallowed into ok=false with err=nil, so a sync whose context was cancelled or timed out while git credential fill was running surfaced the original HTTP 401 instead of context.Canceled / DeadlineExceeded.

The CredentialHelper interface already had an err return (kept "in case" by a //nolint:unparam directive), and tryHelperRetry propagates it — only Lookup itself wasn't using it. Now, when the subprocess fails and ctx is done, we return the wrapped ctx.Err() so callers report the real cause.

Addresses Cursor Bugbot review comment on PR #65: "Cancel masked as HTTP 401".