feat: resumable state manifest, --retry-failed, --sparse-checkout

[blairham]

Summary

• Adds a per-repo _ghorg_state.json manifest written next to _ghorg_stats.csv recording last SHA, status, branch, and error per repo. New --retry-failed flag composes with the existing 7-stage filter pipeline to re-attempt only previously-failed repos. Manifest is human-readable JSON, written atomically (tmp + rename), schema-versioned for future migrations.
• Adds --sparse-checkout flag that plumbs cone-mode patterns through the exec backend (git sparse-checkout init --cone + set post-clone). go-git logs unsupported and skips, mirroring the existing --git-filter precedent. README gains a backend feature matrix documenting which clone modes work where.
• Adds HeadSHA to the Gitter interface so the manifest can record commit hashes; both backends delegate to existing GetRefHash(repo, "HEAD").
• Aligns repo hygiene with the pinpredict Go-stack standard: bumps pre-commit hook revs (pre-commit-hooks v6, pre-commit-golang -repo variants, gitleaks v8.30.1), drops detect-secrets + .secrets.baseline in favor of gitleaks alone, adds .editorconfig, moves goreleaser from asdf into the go.mod tool block (go tool goreleaser ...), drops now-redundant deps-install / deps-verify Makefile targets.

Documentation in README.md and sample-conf.yaml describes the new --retry-failed, --sparse-checkout, the _ghorg_state.json schema, and the backend feature matrix (depth/mirror = both, filter/sparse = exec only).

Test plan

• make fmt && make lint && make test clean across all 7 packages
• make release-check validates .goreleaser.yml via go tool goreleaser
• pre-commit run --all-files (or pre-commit run on staged) green with new config
• New unit tests cover: state manifest round-trip, atomic write, concurrent record, schema-version handling, corrupt-JSON handling, processor recording on success/failure/no-state, retry-failed filter (missing-state, mixed states, no-error states), HeadSHA on both backends, end-to-end sparse-checkout via local bare repo.
• Manual end-to-end (network-dependent): clone a small org with a synthetic failure, confirm _ghorg_state.json lists it as error, then rerun with --retry-failed and confirm only that repo is attempted.
• Manual: --clone-depth=1 --sparse-checkout="docs,README.md" --git-backend=exec produces a shallow, sparse working tree.

Deferred follow-ups

• auth consolidation: internal/configs/configs.go has 5 near-parallel getOrSetXxxToken functions and duplicated macOS Keychain shellouts. Sketch: introduce CredentialResolver interface chained per provider, plus a git credential helper resolver. Separate PR.
• reclone-server hardening: bearer-token auth, /metrics, structured logging, rate limit. Separate small PR.
• Sparse-checkout in go-git remains warn-and-skip; upstream go-git doesn't support it.

🤖 Generated with Claude Code