feat(josh): always pull over http
When we push, josh sometimes seems to pull before it pushes. That causes
our SSH key to be used twice, triggering a double pin entry/etc. with a
security key. That's mildly annoying...
Luckily, we should always be able to pull over http, so we can just use
that for all pulls whether we're nominally using SSH or not!