Support token-authenticated workspace clones

[chubes4]

Summary

• Adds an explicit auth_token_env option to datamachine/workspace-clone.
• Uses a temporary Git HTTP extraheader for HTTPS clones instead of embedding tokens in clone URLs or saved remotes.

Testing

• php -l inc/Workspace/WorkspaceRepositoryLifecycle.php
• php -l inc/Abilities/WorkspaceAbilities.php
• git diff --check

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Diagnosing the docs-agent private repository clone failure and drafting this targeted clone authentication primitive; Chris remains responsible for review and testing.