feat: implement config profile git mounts

- Add git_mounts column to config_profiles table (JSONB)
- Create GitMount Pydantic models with validation
- Add repo validation in create/update endpoints
- Update profile resolver to merge git mounts from includes
- Implement auto-clone, branch checkout, and glob expansion
- Add parallel processing for git mount resolution
- Create GitMountEditor frontend component
- Update TypeScript types and API clients
- Add CSS styles for git mount UI
- Frontend type check and build pass

Implements tasks 1.1-7.9 of config-profile-git-mounts spec

openspec/changes/config-profile-git-mounts/specs/tool-instances/spec.md

@@ -0,0 +1,43 @@
+## ADDED Requirements
+
+### Requirement: Instance startup processes git mounts from config profiles
+The system SHALL process git repository mounts from resolved config profiles during instance startup.
+
+#### Scenario: Instance startup with git mounts
+- **GIVEN** a tool instance configured with a profile that has git mounts
+- **WHEN** the instance starts
+- **THEN** the startup pipeline:
+  1. Resolves the config profile (including inherited profiles)
+  2. Collects all git mounts from the resolved profile
+  3. For each git mount, verifies the repository filesystem path exists
+  4. Creates bind mount entries in the compose file for each valid git mount
+  5. Logs warnings for any invalid or missing git mounts without failing startup
+
+#### Scenario: Git mount bind mount creation
+- **GIVEN** a resolved git mount with:
+  - repository filesystem path: `/data/repos/user/project/dotfiles`
+  - source path: `.`
+  - target path: `/home/user`
+- **WHEN** the instance compose file is generated
+- **THEN** a volume entry is added:
+  ```yaml
+  volumes:
+    - /data/repos/user/project/dotfiles:/home/user:ro
+  ```
+- **AND** the mount is read-only by default
+
+#### Scenario: Repository auto-clone on startup
+- **GIVEN** a git mount referencing a repository that has not been cloned
+- **WHEN** the instance starts
+- **THEN** the system triggers a clone operation using the repository's remote URL and SSH key
+- **AND** the system waits for clone completion before proceeding
+- **AND** the bind mount is created from the cloned repository path
+
+#### Scenario: Clone failure handling
+- **GIVEN** a git mount referencing a repository with an invalid SSH key
+- **WHEN** the instance attempts to clone during startup
+- **THEN** the clone operation fails
+- **AND** an error is logged with details
+- **AND** the mount is skipped
+- **AND** instance startup continues with remaining mounts
+- **AND** the instance status is not affected