fix: supervise repository clone lifecycle

[mistercrunch]

Summary

• supervise remote repository and self-standing branch clones with an explicit lifecycle owner
• terminate and await the full clone process tree on timeout or cancellation, then safely remove partial clone state
• persist a timeout-specific clone_error and prevent late executor events from overwriting the timeout outcome
• block branch creation while a repository is cloning or after its clone has failed, with matching UI readiness/error handling
• cover both initial clone and clone-mode branch creation/unarchive paths without changing full-history clone behavior

Root cause

The observed ~300-second boundary was not a simple-git clone timeout. Remote clone executors inherited the default five-minute scoped service-token lifetime. The daemon launched the executor fire-and-forget and only observed the direct process, while the actual clone could continue in descendant Git transport/index-pack processes. Once the token expired, long clones could no longer report a truthful terminal state, and direct-process handling did not guarantee descendant termination or partial-directory cleanup.

Design

• Start supervised executor commands in dedicated POSIX process groups (or use taskkill /T on Windows).
• On timeout, atomically claim terminal-state ownership, terminate the full group with TERM/KILL escalation, await quiescence, and only then run executor-mediated safe cleanup.
• Use a 30-minute full-clone timeout, a bounded two-minute cleanup window, and a clone-specific token lifetime that covers both plus scheduling margin.
• Preserve explicit user deletion as cancellation rather than classifying it as timeout; cancellation awaits termination before preserving or deleting filesystem state.
• Persist clone_error.category: timeout with exit code 124 and messages that truthfully distinguish successful cleanup, cleanup failure, and inability to prove process-tree termination.
• Add repository/branch repository precedence guards so late ready or generic failure patches cannot replace a timeout state.
• Keep full clones as the default. The timeout is intentionally internal and fixed for now; progress-aware/configurable policy can be added separately once progress reporting and operator-facing configuration semantics are defined.

Issue #2031

This also captures failed clone state and prevents branch creation against repositories whose clone is still in progress or failed. API/MCP and all current UI branch-creation entry points now surface the durable clone error instead of proceeding against an absent or partial checkout.

Verification

• pnpm i
• pnpm check
• pnpm --filter @agor/git exec vitest run src/clone-error.test.ts — 1 test
• pnpm --filter @agor/core exec vitest run src/db/repositories/repos.test.ts src/db/repositories/branches.test.ts src/git/index.test.ts — 198 tests
• pnpm --filter @agor/daemon exec vitest run src/services/repos.test.ts src/utils/process-tree.test.ts src/utils/repo-clone-supervisor.test.ts src/utils/spawn-executor.configured.test.ts — 29 tests
• pnpm --filter agor-ui exec vitest run src/utils/repoReadiness.test.ts src/components/CreateDialog/tabs/BranchTab.test.tsx src/components/NewBranchModal/NewBranchModal.test.tsx src/components/SettingsModal/BranchesTable.test.tsx src/components/SettingsModal/ReposTable.test.tsx — 16 tests

Closes #2030
Closes #2031