feat: add Git repository session resources

[yanpgwang]

Problem

Mango Sessions can stage Files and Skills, but they cannot reproducibly start from a Git repository across Docker and remote sandbox providers. Cloning independently inside each sandbox would make checkout identity, network behavior, and recovery provider-dependent.

The public Claude Managed Agents GitHub repository resource was reviewed as a design reference. Mango needs the underlying workflow, but not its GitHub-only naming, hosted authentication, token, or post-create update semantics.

Solution

Add a Mango-owned git_repository Session Resource:

• accept anonymous public HTTPS repositories when creating a direct Session;
• resolve the default branch, an explicit branch, or a full 40-character commit;
• snapshot the repository once in the control plane, preserve .git, and freeze resolved_commit;
• restore the same writable worktree to Docker, E2B, Cube, OpenSandbox, and Daytona;
• default to /workspace/<repository-name> while allowing validated child paths under /workspace;
• account repository snapshots and staged Files against the same 500 MB Session limit;
• store snapshots through Mango's existing durable File/blob lifecycle while keeping internal snapshot Files out of the public Files API.

This also removes the obsolete GitHub-specific resource update/token route rather than retaining a compatibility shim. The model adapter and /v1/messages inference path are unchanged.

API and migration impact

• Extend the Session Resource union and OpenAPI schema with git_repository, repository_url, checkout, resolved_commit, and mount_path.
• Git repository resources are create-time only: runtime attach/detach and Deployment resources reject them.
• Add migration 00035_git_repository_resources.sql for repository metadata and internal File ownership.
• Rollback first marks repository snapshot Files for deletion, so the existing reconciler can remove blobs safely after the resource rows are removed.
• Update API guides, sandbox documentation, capability summary, and provenance decisions.

Mango is pre-release, so the old vendor-shaped development surface is changed directly on /v1.

Durability, retry, and security

• Repository bytes are captured before Session launch and persisted as a content-addressed blob; retries and provider recovery restore the frozen snapshot instead of recloning a moving branch.
• Clone/snapshot work runs outside database transactions with a bounded five-minute context and bounded archive size.
• Only anonymous public HTTPS URLs are accepted. Userinfo, query strings, fragments, unsafe ports/addresses, branch names beginning with -, credentials, submodule fetching, and LFS fetching are rejected.
• Restore validates workspace ancestors, rejects symlink traversal and non-directories, extracts through bounded tar handling, and leaves a writable checkout.
• Internal repository blobs cannot be listed, downloaded, attached as source Files, referenced by Deployments, or deleted through the public Files API.

Verification

• make verify
• make docs-check
• make security
• make local-config
• make image-smoke
• make test-service against a fresh temporary PostgreSQL database, plus Temporal, NATS, MinIO, and real Docker
• shared remote-provider and real Docker Git repository conformance tests
• git diff --check

Non-goals

• private repositories or hosted-provider credential/token flows;
• runtime repository mutation through the control-plane API;
• Deployment repository resources;
• submodule or Git LFS network fetching;
• changes to model inference, agent orchestration, or environment-worker clients.