Security and reliability improvements from code review

[Copilot]

Code review identified security and reliability gaps. This PR addresses high-priority issues.

Security

• Enhanced credential redaction: Original regex only caught user:pass@ format. Now handles all credential patterns before @ in HTTPS URLs (tokens, passwords, etc.)

  // Now properly redacts: https://token@github.com, https://user:pass@github.com
  const CREDENTIAL_RE = /^(https?:\/\/)([^@]+)@/i;

Reliability

• Default network timeouts: Added 30s default to all Git operations (ls-remote, clone, archive, tar). Prevents indefinite hangs on network issues.

  timeout: params.timeoutMs ?? DEFAULT_TIMEOUT_MS

• Error visibility: Backup restore failures now log warnings instead of silent catch. Preserves diagnostic information without failing operations.

Code quality

• Removed unused lockName parameter from resolveLockPath
• Fixed unused variables flagged by linter
• Created biome.json to exclude build artifacts from linting

Documentation

• REVIEW.md: Comprehensive analysis (architecture, security, testing)
• REVIEW_SUMMARY.md: Executive summary with metrics

All tests passing (38/38), zero CodeQL alerts.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.