feat: expose the repository clone URL and its auth headers

[Meldiron]

What does this PR do?

A provider without archive downloads reports supportsRepositoryArchives() === false, but the library gave consumers nothing to clone with — the authenticated URL existed only inside generateCloneCommand(), as an embedded-credential string in a shell command.

This adds two methods next to the capability:

• getRepositoryCloneUrl($owner, $repositoryName) — the Git HTTPS URL, without credentials. Base Git throws (mirroring getRepositoryPresignedUrl()); Origin overrides.
• getRepositoryCloneHeaders() — the headers that authenticate a fetch of that URL (Origin: Authorization: Basic x-access-token:<installation token>), empty when none are needed.

Credentials ride a header rather than URL userinfo so tokens never surface in the errors and logs that echo URLs verbatim.

First consumer: Appwrite's deployment pipeline hands these to the orchestrator's new clone artifact for providers that serve content over Git HTTPS only (Origin).

Test Plan

• Pint and PHPStan (level 8, src + tests) pass.
• Origin integration suite remains skipped upstream (fixtures cannot be provisioned automatically); the override mirrors authenticatedCloneUrl(), which the skipped suite covers.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR adds a provider-level contract for retrieving a credential-free repository clone URL and separate authentication headers, with an Origin implementation using HTTP Basic authentication.

• Adds default clone URL and header methods to the shared Git adapter.
• Exposes Origin's Git HTTPS endpoint without URL userinfo credentials.
• Returns the installation token through an Authorization header instead.

Confidence Score: 4/5

The PR appears safe to merge, with the non-blocking recommendation to add focused coverage for the new clone URL and authentication-header contract.

The implementation preserves Origin's existing clone target while moving credentials into a Basic Authorization header; no current functional failure was established, but the new public authentication behavior is untested and the Origin integration suite is skipped.

Files Needing Attention: src/VCS/Adapter/Git/Origin.php

Important Files Changed

Filename	Overview
src/VCS/Adapter/Git.php	Adds an optional clone URL/header contract using the established throwing-default capability pattern.
src/VCS/Adapter/Git/Origin.php	Implements a credential-free clone URL and matching Basic Authorization header correctly, but leaves the security-sensitive behavior without automated coverage.

Prompt To Fix All With AI

### Issue 1
src/VCS/Adapter/Git/Origin.php:1714-1732
**Clone authentication contract lacks coverage**

These new public methods define security-sensitive URL and authentication behavior, but no focused test verifies that credentials stay out of the URL, path components are encoded, and the installation token produces the expected Basic header. Since Origin's live integration suite is skipped, regressions can cause private clones to fail or expose credentials without being detected.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat: expose the repository clone URL an..." | Re-trigger Greptile}

[Meldiron]

lgtm