Environment:
Python 3.11+ with pygit2 >= 1.20.0 (the version pinned in uv.lock / requirements.txt for Python 3.11+).

Description:
  
picard/git/backends/pygit2.py, in Pygit2RemoteCallbacks._credentials(), references the module-level constants pygit2.GIT_CREDENTIAL_SSH_KEY and pygit2.GIT_CREDENTIAL_USERPASS_PLAINTEXT.

These flat GIT_* constants were deprecated in pygit2 1.14.0 (2024-01-26, when pygit2.enums was introduced) and removed in pygit2 1.20.0 (2026-08-08, per its CHANGELOG: "Remove deprecated pygit2.legacyenums module and GIT_* constants, use pygit2.enums instead").

 
Since the project's own dependency pins resolve to pygit2 1.20.0 on Python 3.11+, the credentials callback raises AttributeError: module 'pygit2' has no attribute 'GIT_CREDENTIAL_SSH_KEY' whenever git authentication is required (e.g.
  installing/updating a plugin from an SSH or userpass-protected repository). Public HTTPS repositories don't trigger the callback, which is why it has gone unnoticed.
  
  Steps to reproduce:
  
  1. Run Picard on Python 3.11+ with pygit2 ≥ 1.20.0.
  2. Attempt to install or update a plugin from a git remote that requires SSH or username/password authentication.
  3. The credentials callback fires and raises AttributeError; authentication fails.
  
Expected: Authentication proceeds using the appropriate credential type.
Actual: AttributeError on the removed constant; auth fails.

Proposed fix:
Use the pygit2.enums.CredentialType flag enum, which has existed since 1.14.0 and is therefore available across the entire supported range (1.18.2 to 1.20.0), so no version guard is needed.

https://github.com/libgit2/pygit2/blob/master/CHANGELOG.md#1200-2026-08-08
https://github.com/libgit2/pygit2/blob/master/CHANGELOG.md#1140-2024-01-26
https://www.pygit2.org/enums.html#pygit2.enums.CredentialType