feat(workspace): add git workflow backend APIs

[stocky789]

Summary

Adds the backend foundation for workspace source-control workflows: workspace-confined /api/workspace/git/* endpoints for status, diff/stage/unstage/discard, hunk operations, commits, branch switching/creation, remote actions, init/clone, history, commit file stats, blame, and conflict resolution. It also adds workspace file delete support and a focused backend regression suite.

This is intentionally backend-only. The current UI keeps behaving as it does today; the panel UI that consumes these endpoints will be submitted separately so the backend API and safety boundary can be reviewed first.

Follow-up UI context

This PR is the foundation layer for the workspace git UI. It provides the building blocks the follow-up panel uses for status/diff rendering, staging and unstaging, selected-file commits, branch workflows, history, blame, and conflict handling.

The UI changes are intentionally kept out of this PR so reviewers can check the backend API shape, path confinement, and git mutation behaviour first.

The screenshots below are included to show where the Git panel is opened from and the user-facing flow this backend API is intended to support.

The Git panel entry point is available from the chatbox overflow menu:

Changes	Selected diff

Files	History

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release.

Linked Issue

Part of #2451

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Review scope

• routes/workspace_git_routes.py — authenticated workspace git API routes.
• src/workspace_git.py — path confinement, git command execution, mutation locking, and git workflow helpers.
• tests/test_workspace_git_backend.py — backend coverage for auth gating, path rejection, file operations, status/diff, staging, commits, branches, remotes, history, blame, and conflict handling.

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (uvicorn app:app) and verified the branch starts successfully. Type-checks and unit tests are not enough.

How to Test

After rebasing this branch onto the latest upstream/dev, I ran:

uv run python -m compileall -q app.py core routes src services scripts tests
shopt -s globstar nullglob; for f in static/app.js static/js/**/*.js; do node --check "$f" >/dev/null; done
uv run pytest tests/test_workspace_git_backend.py -q

Result:

compileall OK
node --check OK
40 passed, 2 warnings
full suite: 2576 passed, 1 skipped, 43 warnings

I also started the app locally and confirmed it served requests:

uv run python -m uvicorn app:app --host 127.0.0.1 --port 7017
curl -sS -o /tmp/odysseus-root-check.txt -w 'HTTP %{http_code}\n' http://127.0.0.1:7017/
# HTTP 302

The 302 is the expected auth redirect from / on a local authenticated app instance.

Visual / UI changes — REQUIRED if you touched anything that renders

N/A — this PR does not touch CSS, HTML, SVG, or static/js, and it does not change rendered UI components.

Screenshots / clips

Follow-up UI screenshots are included above for context only. This PR does not include the UI implementation.