owning the agent helps, but still it's much better if the credentials don't show up in logs,

They are not, they are always filtered out,

• how does force_git_ssh_protocol help please? it doesn't solve the issue of the agent simply not having accessIt automatically maps the host .ssh into the container, so that git can use SSH to clone.
  What exactly is not working?
  and how are you configuring it?