Credential config for `git.heroku.com` should reset inherited helpers

[edmorley]

The CLI configures a credential helper for git.heroku.com as:

[credential "https://git.heroku.com"]
	helper = !heroku git:credentials

Git treats credential.helper as an additive list, so this appended helper doesn't replace a globally-configured helper — it runs after it.

For users with a global helper such as Git Credential Manager (GCM):

[credential]
	helper = 
	helper = /usr/local/share/gcm-core/git-credential-manager

...GCM is consulted first for git.heroku.com which:

1. Causes unnecessary extra work.
2. Could return a stale cached credential, shadowing heroku git:credentials and causing git push heroku to fail authentication.

Adding a blank helper = reset before the CLI's helper scopes the host to the CLI's helper only. A blank value clears helpers inherited so far for this URL context; other URLs are unaffected:

[credential "https://git.heroku.com"]
	helper =
	helper = !heroku git:credentials

This mirrors how a global [credential] block commonly resets the list before setting its preferred helper. (And is what GCM does in its own config block.)

Reproduction

1. Set a global credential helper, e.g. git config --global credential.helper manager (GCM).
2. Let the CLI write its git.heroku.com credential config.
3. With a stale/incorrect credential cached in GCM for git.heroku.com, run git push heroku — GCM's credential is used instead of heroku git:credentials, and auth fails.

$ heroku --version
heroku/11.9.0 darwin-arm64 node-v22.23.2
$ which heroku
/opt/homebrew/bin/heroku

[eablack]

Thanks for the detailed report — confirmed and valid. credential.helper is an additive list, so the unscoped global helper (e.g. GCM) matches git.heroku.com and gets consulted before the URL-scoped !heroku git:credentials we write, which can shadow it with a stale credential and break git push heroku.

We've filed this internally as W-23914458 to implement the fix — prepending an empty helper = reset ahead of our helper in the git.heroku.com block so only ours applies for that host (with a migration for existing users). Will link the PR here when it's up.