feat: add external repository support for config profile git mounts

- Add POST /repositories endpoint for external repos (no project_id)
- Update GitRepositoryResponse to allow nullable project_id
- Update list_repositories to support listing all user repos
- Add _pull_repository_updates for auto-pull on container creation
- Update git mount validation to allow external repos
- Frontend: Update listRepositories to support optional projectId
- Spec updates: external repos, auto-clone, per-instance isolation

openspec/changes/config-profile-git-mounts/specs/config-profile-git-mounts/spec.md

@@ -14,7 +14,8 @@ The system SHALL allow config profiles to include git repository mounts that bin
 #### Scenario: Git mount validation
 - **WHEN** a profile with git mounts is saved
 - **THEN** the system validates that:
-  - The referenced repository exists and belongs to the user's project
+  - The referenced repository exists and is owned by the user
+  - Repositories can be external (not tied to any project) or project-based
   - `source_path` is a relative path (no leading `/`)
   - `target_path` is an absolute path (starts with `/`)
   - `target_path` does not contain path traversal sequences (`..`)
@@ -59,15 +60,22 @@ The system SHALL support glob patterns in `source_path` for matching multiple fi
 - **AND** logs a warning: "Glob pattern matched 500 files, limited to 100"
 
 ### Requirement: Git mounts trigger automatic cloning
-The system SHALL automatically clone referenced repositories if they do not exist locally.
+The system SHALL automatically clone referenced repositories to a persistent storage location on every new container creation. Each instance gets its own fresh clone.
 
-#### Scenario: Repository not cloned at startup
-- **GIVEN** a git mount referencing a repository that has not been cloned
-- **WHEN** the instance is started
-- **THEN** the system triggers a clone operation using the repository's remote URL and SSH key
+#### Scenario: Repository cloned on container creation
+- **GIVEN** a git mount referencing a repository
+- **WHEN** a new container is created with this profile
+- **THEN** the system clones the repository to a persistent location: `/data/repos/<user_id>/<repo_name>.git`
 - **AND** the clone proceeds asynchronously
 - **AND** instance startup continues once clone completes
 
+#### Scenario: Existing clone updated on new container creation
+- **GIVEN** a repository that was previously cloned to the persistent location
+- **WHEN** a new container is created with this profile
+- **THEN** the system pulls the latest updates from the remote
+- **AND** checks out the specified branch (or default branch if not specified)
+- **AND** uses the updated clone for the bind mount
+
 #### Scenario: Clone failure handling
 - **GIVEN** a git mount referencing a repository with an invalid SSH key
 - **WHEN** the instance attempts to clone
@@ -76,6 +84,12 @@ The system SHALL automatically clone referenced repositories if they do not exis
 - **AND** the mount is skipped
 - **AND** instance startup continues with remaining mounts
 
+#### Scenario: Per-instance isolation
+- **GIVEN** a git mount referencing a repository
+- **WHEN** multiple instances are created using the same profile
+- **THEN** each instance gets its own independent clone
+- **AND** changes made in one container do not affect other containers
+
 ### Requirement: Git mounts support branch pinning
 The system SHALL support pinning git mounts to specific branches or tags.
 
@@ -107,7 +121,7 @@ The system SHALL display git mounts in the config profile editor.
 #### Scenario: Add git mount via UI
 - **WHEN** a user adds a git mount in the profile editor
 - **THEN** they can:
-  - Select from available repositories in the project
+  - Select from all user-owned repositories (external repos not tied to any project are shown)
   - Specify the source path (with autocomplete or validation)
   - Specify the target path in the container
   - Optionally select a branch/tag
@@ -128,7 +142,7 @@ The system SHALL include git mounts in the profile preview/resolve output.
   - Source path (with expanded glob matches if applicable)
   - Target path in container
   - Resolved branch name
-  - Clone status (exists, will clone, clone failed)
+  - Clone status (will clone on container creation)
 
 #### Scenario: Preview warns about missing repository
 - **GIVEN** a config profile with a git mount referencing a non-existent repository

openspec/changes/config-profile-git-mounts/tasks.md

@@ -62,3 +62,14 @@
 - [x] 8.1 Update API documentation with new git_mounts fields
 - [x] 8.2 Add user guide section for using git repositories in config profiles
 - [x] 8.3 Document branch pinning behavior and fallback rules
+
+## 9. External Repository Support
+
+- [x] 9.1 Remove project requirement from git mount validation
+- [x] 9.2 Add endpoint to create external repositories (no project_id)
+- [x] 9.3 Update list_repositories endpoint to return all user repos
+- [x] 9.4 Add endpoint to list external repositories
+- [x] 9.5 Update spec: repos can be external (not tied to project)
+- [x] 9.6 Update spec: auto-clone to persistent location on every container creation
+- [x] 9.7 Update spec: pull updates when creating new containers
+- [x] 9.8 Update spec: per-instance isolation (no shared clones)