fix(emulator): CI-proof the local-gitops commit identity and kubeconfig retry

Two CI failures on the local-gitops / native-emulator work:

- [floci] go e2e: TestLocalGitOpsPushE2E failed with `git commit (exit 128)` —
  the CI runner has no global git identity, and the deployments repo did not pin
  one, so the provisioner's commit hit "Please tell me who you are". Pin
  `commit.author` on the example's deployments repo (the schema documents this as
  required in CI) and make the E2E run with GIT_CONFIG_GLOBAL/SYSTEM=os.DevNull so
  it reproduces the no-ambient-identity runner and self-validates the fix.

- [Acceptance/windows]: TestManager_Resolve_KubernetesKubeconfigError flaked —
  with kubeconfigReadyTimeout=0 the harvest retry used `time.Now().After(deadline)`
  (strict >). On Windows's coarse monotonic clock the first post-attempt read can
  equal the deadline, so it polled again (an extra List call) and tripped the
  mock's Times(2). Use reached-or-passed semantics (`!time.Now().Before(deadline)`)
  so a zero timeout makes exactly one attempt on every platform.

Validated on Podman: push E2E passes with no ambient git identity; emulator unit
tests (incl. the kubeconfig test) pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: osterman

examples/local-gitops/atmos.yaml

@@ -21,6 +21,13 @@ git:
       # demo is self-contained and each fresh `gitserver` lines up with a fresh
       # workdir. `atmos teardown` removes it; the .gitignore keeps it out of git.
       workdir: .atmos/git/deployments
+      commit:
+        # Pin the committer identity so the provisioner's `git commit` works on a CI
+        # runner with no global git user configured (otherwise: "Please tell me who
+        # you are", exit 128). Passed as `git -c user.name -c user.email`.
+        author:
+          name: Atmos GitOps
+          email: atmos-gitops@localhost
 
 stacks:
   base_path: "stacks"

pkg/emulator/kubeconfig.go

@@ -50,7 +50,11 @@ func (m *Manager) Kubeconfig(ctx context.Context, stack, name string) ([]byte, e
 
 		// Only the readiness race (container up, kubeconfig not yet written) is worth
 		// polling. A missing container or an unbound port is terminal — fail fast.
-		if !retryable || time.Now().After(deadline) {
+		// Use >= (reached-or-passed) rather than strictly-after so a zero timeout makes
+		// exactly one attempt on every platform: on coarse-granularity clocks (Windows)
+		// `time.Now()` can still equal the deadline after the first attempt, and a
+		// strict After() would spuriously poll again.
+		if !retryable || !time.Now().Before(deadline) {
 			return nil, lastErr
 		}
 		select {

tests/local_gitops_test.go

@@ -33,8 +33,12 @@ const (
 func gitOpsE2EEnv(workdir string) map[string]string {
 	return map[string]string{
 		"ATMOS_CLI_CONFIG_PATH": workdir,
-		// Don't let a developer's global git identity sign or rewrite demo commits.
-		"GIT_TERMINAL_PROMPT": "0",
+		"GIT_TERMINAL_PROMPT":   "0",
+		// Reproduce a CI runner: no global/system git identity. The provisioner's
+		// commit must succeed via the repo's configured commit.author, not an ambient
+		// developer identity. os.DevNull is cross-platform ("/dev/null" or "NUL").
+		"GIT_CONFIG_GLOBAL": os.DevNull,
+		"GIT_CONFIG_SYSTEM": os.DevNull,
 	}
 }