Fix private Git workspace materialization fallback

[chubes4]

Summary

• Attempt runner-side Git materialization first, then transfer a controller-created bundle only after authentication or network failures.
• Verify the bundle SHA-256 on Lab before checkout, restore only a sanitized origin URL without fetching it, and record controller_git_bundle source SHA, refs, digest, controller cleanup owner, and immediate cleanup TTL.
• Reject credential-bearing HTTP(S) origin URLs before any runner handoff.

Closes #8122

How to test

1. Run CARGO_TARGET_DIR=/Users/chubes/Developer/homeboy@fix-8054-mixed-lease-orphan-recovery/target cargo test controller_routed_git_sync_materializes_private_unavailable_remote_with_changed_since_base --lib.
2. Confirm the inaccessible origin falls back to a controller bundle, Lab has the exact recorded HEAD and sanitized origin, and one tracked-file change is the only patch.
3. Run CARGO_TARGET_DIR=/Users/chubes/Developer/homeboy@fix-8054-mixed-lease-orphan-recovery/target cargo test rejects_credential_bearing_https_remote_without_echoing_the_secret --lib.
4. Run CARGO_TARGET_DIR=/Users/chubes/Developer/homeboy@fix-8054-mixed-lease-orphan-recovery/target cargo test git_bundle_materialization_rejects_digest_mismatch --lib.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode / openai-gpt-5.6-sol
• Used for: Implemented the generic Git-bundle fallback, tests, verification, and PR draft with Chris's requested requirements.