Simplify repository checkout credentials

[lox]

Companion CLI change: buildkite/buildkite-gha#86

Summary

• remove the private-checkout plugin configuration entirely
• stop passing both --private-checkout and the legacy --runtime-queue hosted override in release and source-ref modes
• always invoke buildkite-gha upload <workflow>, regardless of repository-provider credential availability signals
• remove the obsolete private-checkout opt-in and compatibility documentation

Compatibility and security

This intentionally provides no backwards-compatibility shim. Because the plugin schema uses additionalProperties: false, pipeline configurations that still set private-checkout must remove it.

Repository checkout behavior is owned by buildkite-gha and Buildkite's repository-provider backend. The backend remains authoritative for whether credentials are issued for each concrete repository URL. Workflow permissions remain separate: checkout credentials do not populate GITHUB_TOKEN or github.token, enable private actions, or permit alternate repositories or refs.

Queue targeting is also owned by buildkite-gha; supported Ubuntu runner labels continue to target Buildkite's hosted queue without a plugin-supplied upload override.

Tests

• bats tests (24 tests), including true/false values for both repository-provider credential signals producing the exact upload <workflow> command without --runtime-queue or --private-checkout
• exact release, latest-source, and pinned-source invocation coverage
• shellcheck hooks/* lib/*
• bash -n hooks/* lib/*
• git diff --check