Spent a couple evenings reverse engineering how Gerrit auth works, concluded it's OAuth2, started building a proxy to replace the long-lived ~/.gitcookies file...

Then found https://github.com/hickford/git-credential-oauth which works beautifully out of the box. Oh well.