feat(node): add scheduled inbound mirror worker

[gnanam1990]

Dependency

This is a stacked follow-up to #333.

• Do not merge before feat(node): persist upstream mirror configuration and transition state #333.
• The current diff includes the B1a persistence commits because the dependency branch exists only in the contributor fork.
• Rebase onto main after feat(node): persist upstream mirror configuration and transition state #333 merges, then rerun the complete CI matrix.

Summary

• Add a default-off scheduled worker for stable INBOUND mirror rows.
• Keyset-page all eligible repositories and isolate a failure to its repository.
• Serialize updates with the existing process-local lease, global Git semaphore, and PostgreSQL advisory write lock.
• Recheck mirror authority under the write locks before fetching.
• Fetch external HTTPS upstreams atomically into branches and tags while preserving Gitlawb internal and review refs.
• Bound and reap Git child processes.

Network and credential safety

• Require owner-only push enforcement before the worker can start.
• Validate and pin every DNS answer used by Git.
• Reject private, local, special-purpose, translated-private, and documentation address ranges.
• Disable redirects, proxies, ambient credentials, cookies, extra headers, submodules, and alternate protocols.
• Reject repository-local URL rewrites and network or credential configuration.
• Keep valid upstream paths containing an equals sign intact at the Git configuration boundary.

Scope

This PR covers the scheduled-fetch portion of Track B1.

Not included here:

• webhook-triggered fetches
• inbound-to-outbound transition execution
• upstream writeback
• a public API or CLI that activates inbound state

Verification

Passed locally:

• cargo build --locked -p gitlawb-node
• cargo clippy --locked -p gitlawb-node --all-targets -- -D warnings
• cargo fmt --all -- --check
• 12 upstream worker and configuration tests
• 41 peer address-policy tests
• 12 mirror-state tests
• real Git HTTPS transport regression for equals-sign paths

The complete local node test binary finished with 842 of 849 passing. The seven failures are the same host-load-sensitive object-count, deadline, process-watchdog, and IPFS timing names already observed on the B1a baseline; all changed-path tests passed.

A multi-lens internal review reproduced and fixed three blocking defects before this draft was opened: broken HTTPS startup from empty client-certificate settings, incomplete special-purpose address rejection, and invalid Git configuration parsing for equals-sign paths.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 03ab2892-3180-4b4b-87e2-b3fe3619cc1b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}