Everything crq does with git assumes it was RUN inside the checkout it
cares about: the local-work probe shells out with no directory, target
inference reads the current branch. That is right for a command an agent
types from its working copy, and useless for the daemon, which has no
checkout of any repository it reviews — the reason dispatch has nothing
to stand on.

Workspace separates the two: a bare mirror per repository, fetched rather
than re-cloned, and a throwaway detached worktree per head. Detached on
purpose — a place to inspect and build, not a branch to commit to by
accident. A worktree left behind by a killed process is replaced rather
than reused, since the head it holds is stale anyway.

Credentials stay out of it. The remote is the ordinary https URL, so the
host's existing git credential helper supplies the token and crq never
holds a secret it would then have to avoid logging.

One runner now executes every git command, taking the directory to run
in, and it folds stderr into the error — "exit status 128" alone has
never told anybody what went wrong. localWork takes that directory too,
through Config.WorkDir, so a caller working in a worktree it made can say
so without the Service being copied.

The tests build a real repository and clone it, because the thing under
test is whether the git invocations are right.

Six review findings on the workspace, two of them P1.

The mirror tree was created with the umask's 0755, so on a shared host
git wrote a private repository's objects and source world-readable under
~/.cache. The root is 0700 now, enforced rather than assumed.

Clones were unauthenticated in the documented token-only setup: git does
not read GITHUB_TOKEN or GH_TOKEN by itself, so a daemon with no
credential helper would have failed at its first private checkout —
dispatch's first real act. A credential helper is injected when crq has a
token, and the token travels in the environment, never in argv, so a
process listing, a log line and this package's own error strings carry
the helper snippet and not the secret.

Three ways a checkout could destroy another. Two workers first cloning
one repository both passed the missing-HEAD check and cloned into the
same directory; the clone now lands in a staging directory and is moved
into place, and losing that race is fine because the winner's mirror is
just as good. "a-b/c" and "a/b-c" joined with a dash are the same path,
so one repository's cleanup deleted the other's live worktree; owner and
name stay separate components. And a deferred Remove on a stale handle
deleted the checkout that replaced it — each checkout now owns a
generation directory and removes only its own.

CRQ_WORKSPACE is read through Config, so a value in ~/.config/crq/env is
actually used instead of being silently ignored by the daemon.

Four findings, one P1.

Reading only GITHUB_TOKEN and GH_TOKEN meant the documented `gh auth
login` setup produced unauthenticated clones: API calls worked, and every
private checkout failed at dispatch's first real act. git now gets the
same token the API client resolves, `gh auth token` included.

A relative workspace root put the worktree somewhere other than where the
returned path said. `git worktree add` runs inside the mirror, so the
relative directory landed under the mirror while Checkout.Dir pointed at
a path that did not exist. Roots are absolute now.

Clearing a PR's directory before making a new generation force-removed a
checkout another worker might be building in. Old generations are pruned
by age instead, which collects what a killed process left without
touching a live session.

And two workers fetching one mirror race on git's ref locks, so the loser
reported "cannot lock ref" although the winner had just made the mirror
current. That retries briefly and then accepts the mirror as it stands,
rather than failing a dispatch over a fetch somebody else finished.

Four findings, one P1 that would have destroyed a fix session's work.

The mirror was a --mirror clone, whose refspec is +refs/*:refs/*, so the
next `fetch --prune` reached into refs/heads and deleted any branch a
session had created in its worktree — the documented way for a session to
make changes. It is a bare clone now, fetching into refs/remotes/origin/*,
which leaves refs/heads to the sessions.

Pruning read the checkout directory's own timestamp, which editing files
inside does not update: a session busy for twelve hours read as abandoned
and had its worktree force-removed. It measures the newest file under the
checkout instead.

Persistent ref-lock contention on a shared mirror returned an error even
though the mirror was current, failing a dispatch over another worker's
success — the exact case concurrent dispatch has to survive. And the
worktree add now goes through the credential-carrying runner, so a
checkout filter that fetches from a private repository is authenticated
like every other git call.

Applying the refspec only when cloning left every mirror made by an
earlier crq still fetching +refs/*:refs/*. A fix session that created a
branch in its worktree then wedged the WHOLE repository: git refuses to
fetch into a branch checked out somewhere, so every later checkout of
every PR failed with "refusing to fetch into branch ... checked out at".

Observed live — one session's branch stopped the drain from dispatching
anything for hours, while PRs sat with findings nobody was looking at.

The refspec is now enforced on every Mirror call, which migrates the
mirrors that already exist. The test reproduces the original failure: an
old refspec, a branch created in a worktree, and a fetch for a different
PR that has to keep working.

A worktree is made for somebody else to work in, and that somebody runs a plain
`git push`. Every git command in this package injects the credential helper with
-c, which lasts exactly as long as one command, and git reads no GITHUB_TOKEN of
its own — so on a host holding only a token, a caller could do all of its work in
a checkout and fail at the last step of every one of them. Merging this as it
stood would have taken that fix away from the drain again.

So the mirror carries the helper SNIPPET in its own config, written on the clone
path as well as the migration one: another worker picks a mirror up as soon as it
is renamed into place, and would otherwise find one with nothing for its own
commands to use. The secret is still not on disk — what is persisted reads
TokenEnv from the environment, so a mirror somebody finds hands out nothing.

TokenEnv is exported for the same reason: a caller running git in a checkout has
to set it, which makes the name part of the contract rather than a detail.

The read uses gitDir rather than w.git deliberately: w.git injects a helper of
its own, so the check would answer with that injected value and conclude the
mirror was configured when its config was empty.

…pace

# Conflicts:
#	internal/crq/config.go