security: restrict repository clone transports

[harshitethic]

Problem

/api/run passed caller-controlled repo_url directly to git clone. Git accepts more than normal HTTPS remotes, including local filesystem paths, file:// URLs, SSH/scp-style remotes, and other transports. That widened PatchPilot's clone boundary beyond the web-repository workflow documented by the product and could let an API caller make the backend read from local Git repositories or invoke unintended remote transports.

Solution

• validate repository sources before creating a workspace or invoking Git
• require HTTPS repository URLs
• reject embedded URL credentials
• reject query strings and fragments
• require an actual repository path
• reject localhost names and non-global IP literals
• preserve ordinary public HTTPS Git repositories
• add focused regression coverage for local paths, file://, SSH/scp syntax, plain HTTP, embedded credentials, localhost/private IP literals, and query/fragment inputs
• integrate the workspace path-containment fix from merged PR security: contain workspace path resolution #5 so both security boundaries coexist cleanly

Security scope

This closes local/non-HTTPS clone transports and obvious local-network literals. It is not a complete SSRF sandbox: a hostname can still resolve to internal infrastructure, and cloned repository code can execute through approved test tooling. Strong isolation still requires network/process sandboxing or an explicit repository-host allowlist.

Validation

• Local Windows validation after conflict resolution: python -m compileall -q app tests passed.
• Local Windows validation after conflict resolution: python -m unittest discover -s tests -v — 30 tests passed.
• git diff --check passed on the resolved integration.
• Staged diff was scanned for common credential/private-key patterns; no secrets were introduced.
• GitHub Actions Backend CI run #12 passed on final head 616c72255ebdf8fab943a15ea8576f7edb16bfaf for Python 3.11 and 3.12.

Integration state

PR #5 landed first and changed the same backend/test files. This branch now explicitly contains both workspace path containment and repository transport validation, GitHub reports the PR as mergeable, and final CI is green.

AI assistance disclosure: AI assistance was used to identify the clone-transport boundary, implement the focused validation, add regression tests, resolve the post-#5 integration conflict, run validation, review the resulting diff, and inspect CI state.