feat: implement repository clone mode with SSH key support

- Add clone_mode and branch fields to tool_instances
- Add ssh_key_id to git_repositories for per-repo SSH key assignment
- Implement host-side git cloning with branch selection (default: main)
- Mount SSH keys into containers for git operations in clone mode
- Add dirty state check on clone-mode instance deletion with confirmation
- Update SessionsPage with mount/clone selector, branch input, SSH key display
- Add SSH key selector to repository creation form
- Add dirty delete confirmation modal with changed files list
- Update API schemas and endpoints for new fields
- Sync delta specs to main specs (git-repo, tool-instances, repo-clone-mode)
- Archive completed OpenSpec change: repo-clone-mode-with-ssh
- Document git requirement for custom tool types

Quality gates: Frontend typecheck and build passed
OpenSpec: repo-clone-mode-with-ssh archived with all tasks complete

openspec/changes/git-repo-working-clones/design.md

@@ -1,33 +0,0 @@
-## Context
-
-Repository creation currently produces mirrored bare repos for any remote clone and bare repos for blank creations. The workspace, file browser, commit editor, and git toolbar are built around a working-tree repository model, so users can hit 400s when they try to sync or when the repo has no usable branch state.
-
-## Goals
-
-- Create working clones for remote repositories
-- Create working repos with an initial branch for blank repositories
-- Preserve the existing repository create endpoint and shared UI flow
-- Keep fetch/pull/push aligned with a normal local clone
-
-## Decisions
-
-1. Clone mode
-- Use `git clone` without `--mirror`
-- Keep the existing remote URL preflight and URL parsing behavior
-
-2. Blank repositories
-- Initialize with `git init -b main` when supported
-- Fall back to `git init` plus `git symbolic-ref HEAD refs/heads/main` if needed
-
-3. Branch state
-- Treat `main` as the initial branch name for blank repos
-- Make branch listing and current-branch helpers tolerate unborn `HEAD`
-
-4. Pull behavior
-- Prefer the current branch when no explicit branch is supplied
-- Do not force `origin <branch>` if the branch is unborn or already tracked by the current checkout
-
-## Risks
-
-- Some older git versions may not support `git init -b`; the backend should fall back cleanly
-- Existing blank repos created under the old bare model may still require migration or cleanup outside this change

openspec/changes/git-repo-working-clones/proposal.md

@@ -1,17 +0,0 @@
-## Why
-
-The current repository creation flow creates mirrored bare repositories for clone-based repos. That breaks the workspace model because the UI and file editing features expect a normal working clone with an initial branch, remote tracking, and pull/fetch behavior that works from a checked-out branch.
-
-## What Changes
-
-- Create clone-based repositories as normal working clones instead of mirrors
-- Initialize blank repositories as working clones with an initial branch when needed
-- Ensure newly created repos have a usable current branch for workspace browsing and commits
-- Update pull semantics to use the current tracked branch when available
-- Keep fetch behavior available for remote-synced repositories
-
-## Impact
-
-- Backend: repository creation and git control helpers
-- Backend tests: clone, pull, and empty-repo branch behavior
-- Frontend: no intentional UX change beyond sync behavior becoming reliable

openspec/changes/git-repo-working-clones/tasks.md

@@ -1,19 +0,0 @@
-## 1. Backend - Repository Creation
-
-- [x] 1.1 Switch clone-based repository creation from mirror clones to normal working clones
-- [x] 1.2 Initialize blank repositories with a default branch name
-- [x] 1.3 Preserve remote preflight and clear error handling
-
-## 2. Backend - Git Sync Helpers
-
-- [x] 2.1 Update pull behavior to use the current tracked branch when available
-- [x] 2.2 Make branch helpers tolerate unborn HEAD in blank repos
-
-## 3. Tests
-
-- [x] 3.1 Add unit coverage for clone creation and blank repo initialization
-- [x] 3.2 Add coverage for pull behavior on working clones and blank repos
-
-## 4. Quality Gates
-
-- [x] 4.1 Run targeted API tests