feat(git): classify Git host rate-limit responses as their own error state (#1884)

A Git host throttle response (a 429, or a sideband message naming a
rate limit or abuse-detection mechanism) previously fell through to
AUTH_FAILED or a generic GIT_ERROR depending on the host's exact
wording, telling the operator to check a credential that was never
the problem.

Adds RATE_LIMITED to the transport-facing error model, mapped to HTTP
429, checked ahead of the auth-shaped branches in classifyGitFailure.
Proven against a real git binary: git's smart-HTTP client never
surfaces the HTTP response body in stderr, only the status line, so a
host that throttles via a bare 403 stays indistinguishable from a
rejected credential and correctly classifies as AUTH_FAILED; only an
explicit 429, or a sideband remote: message naming the throttle,
classifies as RATE_LIMITED.

docs/features/git-transport-support.mdx

@@ -57,7 +57,6 @@ Every "Supported" row here is backed by a test that runs on every change to Senc
 
 ## Not supported
 
-- **No rate-limit classification.** A Git host rate-limit response (for example GitHub's secondary rate limits) is not classified as its own error state. It surfaces as an authentication failure or a generic transport error depending on the host's exact response. Wait and retry; there is no dedicated rate-limit message or backoff guidance yet.
 - **No Git LFS.** Compose and env files tracked via Git LFS are rejected rather than silently fetched as pointer stubs. Commit plain files instead.
 - **No submodules.** Submodule contents are not fetched. Inputs and build contexts that reference submodule contents are refused with an actionable message; a warning is shown when .gitmodules is present.
 - **No sparse or partial clone.** Every fetch materializes the complete repository at the resolved commit (shallow, single-branch); there is no sparse or partial clone for large monorepos.

docs/git-transport-support.yaml

@@ -549,10 +549,6 @@ claims:
       attestation: att-2026-09-01-github-pilot
 
 limitations:
-  - id: no-rate-limit-classification
-    title: No rate-limit classification
-    statement: A Git host rate-limit response (for example GitHub's secondary rate limits) is not classified as its own error state. It surfaces as an authentication failure or a generic transport error depending on the host's exact response. Wait and retry; there is no dedicated rate-limit message or backoff guidance yet.
-
   - id: no-git-lfs
     title: No Git LFS
     statement: Compose and env files tracked via Git LFS are rejected rather than silently fetched as pointer stubs. Commit plain files instead.
@@ -606,6 +602,10 @@ error_model:
     label: Commit not reachable on this host
     status: 400
     meaning: A pinned commit SHA that the Git host will not serve because it is not advertised by any branch or tag tip.
+  - code: RATE_LIMITED
+    label: Rate limited
+    status: 429
+    meaning: The Git host throttled the request (an HTTP 429, or a sideband message naming a rate limit or abuse-detection mechanism). Wait and retry; there is no automated backoff yet.
   - code: NETWORK_TIMEOUT
     label: Network timeout
     status: 504