fix: Skip redundant git config writes in SignIn when already correct (#2298)

## Summary
- Fixes a bug where `git fetch` on Azure Repos would unconditionally
write `git config --global credential.azrepos:org/<org>.username` and
`git config --local --unset credential.azrepos:org/<org>.username` on
every invocation, even when the binding state was already correct.
- `SignIn` now checks whether the desired state is in place and skips
config writes when nothing needs to change.
- Adds `SetCallCount`/`UnsetCallCount` counters to
`TestGitConfiguration` so tests can assert whether config operations
actually fired.

## Root cause
On every `git fetch`, git calls `credential approve` after successful
authentication, which invokes `StoreCredentialAsync` → `SignIn`. The
`else` branch of `SignIn` (global absent or matches signing-in user)
called `Bind(global)` + `Unbind(local)` unconditionally. In the common
single-user steady state (`A | - → A | -`) this issued two no-op `git
config` writes per fetch.

## Behavior changes
| State before SignIn | Before fix | After fix |
|---------------------|------------|-----------|
| `A \| -` (steady state) | `Set(global)` + `Unset(local)` | no writes |
| `A \| A` | `Set(global)` + `Unset(local)` | `Unset(local)` only |
| `A \| B` | `Set(global)` + `Unset(local)` | `Unset(local)` only |
| `B \| A` (steady state) | `Bind(local)` (no-op) | no writes |

## Test plan
- [x] 4 new tests assert exact write counts for each no-op/minimal-write
case
- [x] All 165 existing `Microsoft.AzureRepos.Tests` tests pass

Author: mjcheetham

src/shared/Microsoft.AzureRepos.Tests/AzureReposBindingManagerTests.cs

@@ -628,6 +628,93 @@ public void AzureReposBindingManager_SignIn_OtherGlobalOtherLocal_BindsLocal()
             Assert.Equal(user2, actualGlobalUser);
         }
 
+        // Idempotency: SignIn when state is already correct should not write to git config
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_SameGlobalNoLocal_NoConfigWrites()
+        {
+            // Steady-state: global already bound to signing-in user, no local override.
+            // This is the common case on every 'git fetch' after the first sign-in.
+            const string orgName = "org";
+            const string user1 = "user1";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user1};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(0, git.Configuration.UnsetCallCount);
+        }
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_OtherGlobalSameLocal_NoConfigWrites()
+        {
+            // Steady-state: a different user holds the global binding, and local is already
+            // bound to the signing-in user. No change needed.
+            const string orgName = "org";
+            const string user1 = "user1";
+            const string user2 = "user2";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user2};
+            git.Configuration.Local[CreateKey(orgName)] = new[] {user1};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(0, git.Configuration.UnsetCallCount);
+        }
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_SameGlobalSameLocal_OnlyUnbindsLocal()
+        {
+            // Global already matches, local redundantly mirrors it.
+            // Only the local unset is needed; re-writing the global value is wasteful.
+            const string orgName = "org";
+            const string user1 = "user1";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user1};
+            git.Configuration.Local[CreateKey(orgName)] = new[] {user1};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(1, git.Configuration.UnsetCallCount);
+        }
+
+        [Fact]
+        public void AzureReposBindingManager_SignIn_SameGlobalOtherLocal_OnlyUnbindsLocal()
+        {
+            // Global already matches, local has a different user that needs removing.
+            // Only the local unset is needed; re-writing the global value is wasteful.
+            const string orgName = "org";
+            const string user1 = "user1";
+            const string user2 = "user2";
+
+            var git = new TestGit();
+            var trace = new NullTrace();
+            var manager = new AzureReposBindingManager(trace, git);
+
+            git.Configuration.Global[CreateKey(orgName)] = new[] {user1};
+            git.Configuration.Local[CreateKey(orgName)] = new[] {user2};
+
+            manager.SignIn(orgName, user1);
+
+            Assert.Equal(0, git.Configuration.SetCallCount);
+            Assert.Equal(1, git.Configuration.UnsetCallCount);
+        }
+
         #endregion
 
         #region SignOut

src/shared/Microsoft.AzureRepos/AzureReposBindingManager.cs

@@ -283,12 +283,24 @@ public static void SignIn(this IAzureReposBindingManager bindingManager, string
             if (existingBinding?.GlobalUserName != null &&
                 !StringComparer.OrdinalIgnoreCase.Equals(existingBinding.GlobalUserName, userName))
             {
-                bindingManager.Bind(orgName, userName, local: true);
+                // Global is bound to a different user (B); bind this user locally (-> B | A).
+                // Skip the write if local is already correct.
+                if (!StringComparer.OrdinalIgnoreCase.Equals(existingBinding.LocalUserName, userName))
+                {
+                    bindingManager.Bind(orgName, userName, local: true);
+                }
             }
             else
             {
-                bindingManager.Bind(orgName, userName, local: false);
-                bindingManager.Unbind(orgName, local: true);
+                // Global is absent or already matches; ensure global is set and local is clear.
+                if (existingBinding?.GlobalUserName is null)
+                {
+                    bindingManager.Bind(orgName, userName, local: false);
+                }
+                if (existingBinding?.LocalUserName is not null)
+                {
+                    bindingManager.Unbind(orgName, local: true);
+                }
             }
         }
 

src/shared/TestInfrastructure/Objects/TestGitConfiguration.cs

@@ -16,6 +16,9 @@ public class TestGitConfiguration : IGitConfiguration
         public IDictionary<string, IList<string>> Local { get; set; } =
             new Dictionary<string, IList<string>>(GitConfigurationKeyComparer.Instance);
 
+        public int SetCallCount { get; private set; }
+        public int UnsetCallCount { get; private set; }
+
         #region IGitConfiguration
 
         public void Enumerate(GitConfigurationLevel level, GitConfigurationEnumerationCallback cb)
@@ -68,6 +71,7 @@ public bool TryGet(GitConfigurationLevel level, GitConfigurationType type, strin
 
         public void Set(GitConfigurationLevel level, string name, string value)
         {
+            SetCallCount++;
             IDictionary<string, IList<string>> dict = GetDictionary(level);
 
             if (!dict.TryGetValue(name, out var values))
@@ -107,6 +111,7 @@ public void Add(GitConfigurationLevel level, string name, string value)
 
         public void Unset(GitConfigurationLevel level, string name)
         {
+            UnsetCallCount++;
             IDictionary<string, IList<string>> dict = GetDictionary(level);
 
             // Simulate git