Add protocol v2 negotiation and bundle-uri advertisement to direct Git endpoint

[0lut]

Summary

Implements item (c) from docs/clean-slate-design.md, "bundle-uri offload": clients that opt in (git >= 2.38, transfer.bundleURI=true) download the repo's published generation bundles directly from the object store / CDN and only fetch a small top-up pack from the cache node. Off by default.

Scope discovery: bundle-uri requires Git wire protocol v2, but the direct-git GET path synthesizes a v0-only ref advertisement (synthesize_ref_advertisement). So this PR includes minimal protocol v2 support as a prerequisite:

• GET info/refs with Git-Protocol: version=2 → still performs the same upstream ls-remote access proof, then responds with a synthesized v2 capability advertisement (new materializer/protocol_v2.rs). bundle-uri capability is included only when enabled and a base URL is configured.
• POST upload-pack v2 bodies (first pkt command=<name>):
  • ls-refs → synthesized from the same UpstreamRefComparison used for the v0 advertisement (preserves the freshness/access-proof contract), honoring ref-prefix / symrefs args.
  • fetch → existing read-through flow, spawning git upload-pack with GIT_PROTOCOL=version=2 (upload_pack_spawn_v2).
  • bundle-uri → synthesized from the repo's generation chain, root-first, as bundle.g{generation}.uri={base_url}/{bundle_key} with bundle.mode=all. Empty list when disabled or no generations.
  • unknown commands → 400 Validation error.

config: git_remote.bundle_uri_enabled (default false)
        git_remote.bundle_uri_base_url (Option<String>)
env:    GIT_CACHE_GIT_REMOTE_BUNDLE_URI_ENABLED
        GIT_CACHE_GIT_REMOTE_BUNDLE_URI_BASE_URL

There is intentionally no bundle-serving HTTP endpoint: generation bundles already live in the object store at bundle_key, so the operator points bundle_uri_base_url at whatever serves those keys (CloudFront/S3/file://). Older clients ignore the advertisement and clone normally; visit_upload_pack_lines now skips flush/delim packets so v2 bodies parse correctly.

Note: this will conflict with #79 (content-addressed packs, design-doc item (d)) — once one merges, the bundle-uri advertisement will need rebasing onto the pack-based generation layout.

Tests: unit tests for pkt-line synthesis/parsing and config round-trips, plus a new integration suite (protocol_v2_integration.rs) running real git -c protocol.version=2 clients: v2 clone, ls-remote with symref HEAD, bundle-uri clone end-to-end against a file:// base URL (trace-verified when client git >= 2.38), disabled-path fallback, and direct HTTP assertions on the bundle-uri/unknown-command responses.

Link to Devin session: https://app.devin.ai/sessions/a5e627993756406f84d6d0b40d3a4165
Requested by: @0lut

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring