Add GitService foundation + schema for git integration

[JMRussas]

Summary

• Adds GitService — stateless git operations service wrapping subprocess calls via asyncio.to_thread() with configurable timeout
• Adds schema migration (010) with git columns on projects (repo_path, git_base_branch, git_project_branch, git_worktree_path, git_state_json) and tasks (git_branch, git_commit_sha)
• Wires git config constants, Pydantic schema fields, route updates for project create/update/read, and DI container registration

This is Phase 1 of 5 from the git integration plan. It adds the foundation (service + data model) without any execution wiring. Subsequent phases will integrate with the executor, add git tools for agents, API routes, and worktree isolation.

GitService capabilities

• Repo validation, branch CRUD, checkout, merge (FF preferred, conflict detection)
• Worktree create/remove
• Stage + commit with configurable author
• Diff (committed, staged, working), status, log
• Dirty state detection with "is ours" heuristic (author match, .orchestration/ dir, branch prefix)
• Backup dirty state to branch, discard changes, revert commits
• Push branch, create PR via gh CLI (graceful fallback)

Config additions (config.example.json)

"git": {
  "enabled": true,
  "commit_author": "Orchestration Engine <orchestration@local>",
  "branch_prefix": "orch",
  "non_code_output_path": ".orchestration",
  "auto_pr": true,
  "pr_remote": "origin",
  "command_timeout": 30
}

Test plan

• 33 new unit tests in tests/unit/test_git_service.py — all use real temp git repos, no mocking
• Full test suite passes: 561 passed, 0 failed
• Covers: repo validation, branch ops, commit ops, diff ops, status/log, dirty state detection, merge (FF/conflict/regular), worktree, backup/discard/revert, error handling

Generated by Claude Code · Claude Opus 4.6

[JMRussas]

Self-Review Findings

Cross-branch contamination: CLEAN

Verified full git diff main...HEAD — no leaked changes from feature/mcp-external-executor (no claimed_by, claimed_at, api_keys, ExecutionMode, EXTERNAL_CLAIM_TIMEOUT_SECONDS).

Schema consistency: PASS

All 3 locations (connection.py inline, models_metadata.py SA, migration 010) define the same 7 columns with matching types and defaults.

Defects found and fixed (commit db8ee1f)

1. create_pr — TimeoutExpired not caught (git_service.py:455)
subprocess.TimeoutExpired inherits from SubprocessError, not OSError. If gh hangs past the timeout, the exception would propagate uncaught. Fixed by adding explicit except subprocess.TimeoutExpired clause.

2. get_log — pipe delimiter fragile (git_service.py:303)
Format %H|%an|%ae|%s|%aI uses | as delimiter, but commit subjects can contain |. Fixed by switching to ASCII unit separator (\x1f).

3. backup_dirty_state — docstring unclear (git_service.py:373)
Clarified that after backup, the original branch is left clean (all dirty changes committed to backup branch).

Known limitations (not bugs, intentional or deferred)

4. check_dirty file parsing — line[3:] assumes standard --short format (2-char status + space). Renamed files (R old -> new) will parse oddly. Acceptable for Phase 1 — Phase 2 lifecycle hooks can use --porcelain for stricter parsing.

5. clone_project doesn't copy git columns — Cloned projects will have repo_path=NULL even if source had one. Intentional: clones start fresh; binding the same repo would cause conflicts.

[JMRussas]

Post-Rebase Review

Reviewed the full diff (git diff origin/main...HEAD, 11 files, 971 insertions) after rebasing onto main (analytics PR merge).

Conflict resolution

• models_metadata.py: Main already had our git columns (merged via analytics PR) plus claimed_by/claimed_at. Resolution: keep both. File has zero diff against main now.
• Migration renumbered from 010 → 011, chaining from "010" (usage task index). The old down_revision was also wrong ("009_task_events_fk_and_indexes" vs actual revision ID "009").

Defect found and fixed (commit 182570c)

merge_branch() conflict file parsing was incomplete. Only matched UU and AA conflict markers, missing DD, AU, UA, DU, UD. The merge was correctly detected and aborted, but the conflict_files list would have been incomplete for non-standard conflicts. Fixed by checking against all 7 unmerged status codes.

Design limitation (not a bug, deferred)

ProjectUpdate can't set repo_path/git_base_branch back to NULL via PATCH. The if body.repo_path is not None pattern prevents clearing the field. Not an issue for Phase 1 (repo binding isn't wired to execution yet), but should be addressed in Phase 2.

Pre-existing issue on main (not this PR)

connection.py and models_metadata.py are out of sync: models_metadata.py has claimed_by, claimed_at, and api_keys table from the analytics PR, but connection.py (inline test schema) doesn't. This drift exists on main already.

Cross-contamination check: CLEAN

All 11 files are git-integration only. No analytics, external execution, API key, or other unrelated changes present.