feat(git): swap isomorphic-git for native git transport behind clone seam (#1849)

* feat(git): swap isomorphic-git for native git transport behind clone seam

Replace the isomorphic-git engine (HTTP-only, single importer) with the
native git CLI behind the existing withClonedRepo seam, so SSH deploy
keys, ref semantics, and private CAs become reachable in later PRs.

- resolve-before-fetch: ls-remote pins the branch to an immutable SHA,
  then rev-parse verifies the checkout against it; tip races refuse
- hardened spawns: argv arrays only, protocol allowlist (https only),
  neutralized hooks, isolated HOME and all config channels, no prompts
- token reaches git only via a credential helper reading SENCHO_GIT_TOKEN
  from the child env; never argv or URL
- size cap becomes a workspace watchdog (on-disk measure) keeping the
  same knob and breach message; deterministic final gate added
- Windows: pin http.sslBackend=openssl (schannel ignores sslCAInfo) and
  anchor to Git's bundled CA; NODE_EXTRA_CA_CERTS combines with platform
  defaults instead of replacing them
- error classification retargets to exit code + stderr while preserving
  the contractual mappings (AUTH_FAILED maps to 400, never 401;
  unauthenticated refusals mask as REPO_NOT_FOUND)
- runtime image installs git; tests re-pointed at the transport boundary
  plus a new engine suite (classifier corpus, argv hardening, watchdog)

Zero externally visible behavior change except two edge cases: an empty
branch now surfaces BRANCH_NOT_FOUND, and a mid-fetch force push refuses
instead of materializing the moved tip.

* fix(git): unblock CI on linux kill-path test and codeql log warning

Two CI-only findings from the first pipeline run:

- The scripted spawn child in the transport tests lacked the kill method
  that killTree's POSIX fallback reaches when a fake process group does
  not exist; Linux runs crashed inside the timeout tests while Windows
  (taskkill branch) could not reproduce it. Give the fixture the method
  the real ChildProcess always has.
- CodeQL flagged the workspace-removal warning that interpolated the
  NODE_EXTRA_CA_CERTS path (environment-sourced values are treated as
  sensitive at log sinks). Reword the warning to name the variable
  instead of its value; operators know their own environment.

* fix(git): collapse remaining duplicated test setup so the shared helper is used

* fix(git): close watchdog, size-gate, ref-validator, and kill-ordering gaps in native transport

Resolves the release-blocking findings from an independent pre-merge audit
of the native git transport swap:

- A watchdog-triggered kill mid-clone was misclassified as a generic exit
  failure instead of a size breach, because runGit resolves (not rejects)
  when the child is killed via SIGKILL.
- The final on-disk size measurement failed open when it could not be
  read (workspace removed mid-walk, permissions), letting an unmeasured
  clone through as a success. Now fails closed and logs the real cause.
- The ref-name validator was an overly restrictive allow-list that
  rejected valid branch names (leading underscore, non-ASCII, '#').
  Replaced with a deny-list matching real `git check-ref-format --branch`
  semantics, verified against the git binary, including a per-path-segment
  `.lock` check the first pass missed.
- runGit's timeout handler settled as soon as a kill was issued rather
  than confirmed, racing workspace cleanup against a still-alive child
  tree. It now waits for the child's close event, with a bounded fallback
  if termination is never confirmed, and preserves the timeout
  classification if 'error' fires after the kill.
- Windows killTree now also falls back to child.kill() when taskkill
  itself exits non-zero, not just when it fails to spawn.
- Added a real, non-mocked integration test that drives the credential
  helper through the actual git binary against a local HTTPS server with
  Basic Auth checking. It caught a genuine bug the mocked suite could not
  see: the credential.helper config value was quoted in a way that broke
  git's own absolute-path helper detection, failing every authenticated
  clone. Fixed by removing the quotes.
- Migrated a separately developed test file's mocks off the deleted
  isomorphic-git module onto the native transport seam, matching the
  pattern already used elsewhere, after merging with main pulled in that
  feature.

Also updates two stale comments left over from the isomorphic-git era and
adds a git version check to the Docker runtime image smoke tests.

* fix(git): make credential-helper path safe, unify ref length, and fix Windows kill ordering

Addresses three PR 1 correction items from pre-merge audit:

- credential.helper is a shell string, not argv: interpolating the
  helper's workspace-relative path broke authenticated fetches whenever
  the workspace sat under a directory with a space in its name. The
  config value is now a fixed string that names an environment
  variable instead, so no workspace path character can affect how
  git's shell parses it.
- The transport rejected branch names over 200 characters while the
  route accepted up to 256 and real git has no comparable limit.
  REF_MAX_LEN is now a single exported constant shared by the
  transport and both routes.
- On Windows, taskkill runs as a separate process and could still be
  walking a killed process tree after the direct git child reported
  closed, letting the caller delete the workspace early. Kill
  operations are now awaited to completion (bounded by a timeout)
  before a timed-out or size-breached run settles, on both the close
  and error event paths.

Verified against a real authenticated git server inside the built
runtime image: public HTTPS, private HTTPS with a valid PAT, invalid
PAT, a deleted branch, an oversized repository, and the awkward
workspace-path case, including from a workspace path containing
spaces and shell metacharacters.

* fix(git): reap killed helpers and classify curl refusals

backend/src/services/git/credentialHelper.ts

@@ -0,0 +1,67 @@
+import { promises as fs } from 'fs';
+import path from 'path';
+
+/**
+ * Credential handoff for authenticated HTTPS clones.
+ *
+ * The token must never appear in argv, in the repository URL, or in any
+ * generated subprocess metadata. Git's credential-helper protocol is the
+ * sanctioned side channel: git invokes the helper with request attributes on
+ * stdin and reads key=value lines from stdout. We write a tiny per-fetch
+ * helper script that echoes the password straight from an environment
+ * variable, and pass the actual token only through the child process env.
+ *
+ * The helper lives under the fetch workspace's `.meta/` directory, which the
+ * caller deletes in its `finally` block together with the rest of the
+ * workspace.
+ *
+ * Locating the helper: its path travels in the child environment, never in
+ * the config value. Git treats `credential.helper` as a SHELL string, not as
+ * argv: run-command's shell detection routes the value through `sh -c` as
+ * soon as it contains any of `|&;<>()$\`\\"' \t\n*?[#~=%`, and a space is in
+ * that set. Interpolating the path directly therefore word-splits whenever
+ * the workspace sits under a directory with a space in its name (a plain
+ * `/tmp/some dir` or a Windows `C:/Users/Ada Lovelace/AppData/Local/Temp`),
+ * and git ends up executing the first path segment. Quoting the interpolated
+ * path fixes that one case but keeps the path inside a shell string, one
+ * unusual character away from breaking again. Pointing the shell at an
+ * environment variable instead makes the config value a CONSTANT, so no
+ * workspace path can affect how it parses.
+ */
+
+export const GIT_TOKEN_ENV_VAR = 'SENCHO_GIT_TOKEN';
+export const GIT_HELPER_PATH_ENV_VAR = 'SENCHO_GIT_HELPER';
+export const GIT_HELPER_USERNAME = 'x-access-token';
+
+/**
+ * The `credential.helper` value. The leading `!` tells git to run the rest as
+ * a shell command (gitcredentials(7)); the quoted variable expands inside
+ * that shell to the path we exported, whatever characters it holds.
+ */
+export const CREDENTIAL_HELPER_CONFIG_VALUE = `!"$${GIT_HELPER_PATH_ENV_VAR}"`;
+
+/**
+ * One POSIX script on every platform. Because the value above always routes
+ * through a shell, the helper is always launched by git's own `sh` (Git for
+ * Windows ships one and uses it for exactly this), so a `.cmd` variant would
+ * add a second dialect without ever being reached more directly.
+ */
+const HELPER_SCRIPT = '#!/bin/sh\n'
+    + `printf 'username=${GIT_HELPER_USERNAME}\\n'\n`
+    + `printf 'password=%s\\n' "$${GIT_TOKEN_ENV_VAR}"\n`;
+
+/** Render the helper script body; exported for tests pinning the no-secret invariant. */
+export function renderCredentialHelper(): string {
+    return HELPER_SCRIPT;
+}
+
+/**
+ * Write the helper executable into `metaDir` and return its absolute path
+ * (forward slashes; git's shell accepts that spelling on Windows too). The
+ * script contains only a variable REFERENCE, never the secret itself.
+ */
+export async function writeCredentialHelper(metaDir: string): Promise<string> {
+    const helperPath = path.join(metaDir, 'credential-helper.sh');
+    await fs.writeFile(helperPath, HELPER_SCRIPT, { mode: 0o700 });
+    return helperPath.split(path.sep).join('/');
+}