feat: bare-clone the data repo, eliminate the working tree (closes #85)

[themightychris]

Summary

The pod was carrying a working tree it never read. gitsheets reads/writes via hologit's tree-object interface, so the checked-out files were a redundant on-disk copy and an active CPU cost — hologit's getWorkspace() hashes the entire working tree on every workspace construction when one is set (node_modules/hologit/lib/Repo.js:86-97).

Switching to a bare clone removes both. The pod re-clones from origin on every restart (objects-only, ~50 MB), which is cheap, and the emptyDir volume sidesteps the PVC Multi-Attach errors we hit during failover.

What landed

• Spec — specs/behaviors/storage.md now declares the bare-clone invariant; three commitments enumerated (openRepo with no workTree, reconcile via plumbing, emptyDir-backed volume).
• openPublicStore — opens with { gitDir: repoPath } (no workTree); fails loudly on non-bare paths with a remediation message pointing at the spec.
• Reconcile rewrite — apps/api/src/store/reconcile.ts swaps three working-tree-touching commands for plumbing equivalents:
  • git merge --ff-only → git update-ref refs/heads/<branch> <new> <old> (CAS-protected)
  • git rebase → per-commit replay loop: git merge-tree --write-tree --merge-base=<C^> <newTip> <C> then git commit-tree, preserving author/message metadata and resetting committer to the API's pseudonymous identity (same as today's git rebase behavior)
  • git reset --hard (escape hatch) → git update-ref
• Reconcile tests — all 7 cases (in-sync, fast-forwarded, pushed-ahead, rebased, conflict-escaped, fetch-failed, refspec regression) pass against bare clones. The conflict-escape's "no half-rebase left behind" assertion holds naturally with plumbing.
• Entrypoint — git clone --bare --branch $CFP_DATA_BRANCH; bare marker is objects/ at the path root; refuses to operate against a stray non-bare clone with a clear remediation message.
• Kustomize — data volume swapped from PVC to emptyDir{}; pvc-data.yaml deleted; kustomization.yaml drops the reference.
• Test helpers — createTestRepo / createFullDataRepo build bare gitdirs + use a transient working-tree clone to seed initial commits via push. New seedRawToml helper (in seed-fixtures.ts) centralizes the transient-clone-push pattern for ad-hoc fixture seeds — replaces identical-shape blocks in account-claim, auth, github-oauth, saml tests.
• Importer + scrub-data — both updated for bare semantics (importer's ensureBranchCheckedOut uses update-ref + symbolic-ref; scrub-data copies .gitsheets/ configs via git ls-tree + git show instead of filesystem readdir).
• Docs — docs/operations/deploy.md boot sequence + env table, docs/operations/runbook.md recovery procedure (drop the delete-PVC step), .claude/CLAUDE.md Local setup section.

All 241 API tests pass. type-check and lint clean.

Test plan

• npm run -w packages/shared build && npm run type-check && npm run lint
• npm run -w apps/api test — 241/241 pass
• npm run -w packages/shared test — 53/53
• npm run -w apps/web test — 30/30
• kubectl kustomize deploy/kustomize/overlays/sandbox renders cleanly; data volume is emptyDir: {} and no codeforphilly-data PVC is emitted
• Sandbox smoke (deferred to deploy) — apply manifests; pod boots; /api/health/ready reaches 200; git-pod-uploadpack.sh operator helper still fetches
• Hot-reload webhook (deferred to deploy) — push to published; pod logs the short-circuit or rebuild line; site reflects the change
• Boot-time measurement (deferred to deploy) — capture first-boot git clone --bare duration on the live remote; should be <30s for our current data size

Closes #85.

🤖 Generated with Claude Code