feat: support Git repository cloning in spawn workflow

[MioYuuIH]

Summary

Add support for users to optionally clone a Git repository when spawning a new session. The repository is cloned via an init container and automatically cleaned up when the session ends (ephemeral, not persisted between sessions).

Changes

Git Clone Backend (runtime/hub/core/spawner/kubernetes.py)

• Add _validate_and_sanitize_repo_url() with URL normalization (prepend https://, strip /tree/<branch>, strip .git)
• Add _extract_repo_name() and _build_git_init_container() for init container construction
• Parse repo_url, repo_branch, access_token from spawn form
• Clone repo via init container using emptyDir volume, use preStop lifecycle hook to clean up on session end
• Auto-set default_url to open the cloned repo directory in JupyterLab
• Configurable ALLOWED_GIT_PROVIDERS, MAX_CLONE_TIMEOUT, GIT_INIT_CONTAINER_IMAGE from values.yaml
• Config defaults consolidated into single source of truth via configure_from_config()
• Pod monitor guards against stale Failed status from reflector cache
• Clone path dynamically derived from home volume mount via _get_home_mount_path() (no hardcoded /home/jovyan)
• notebook_dir set to home mount path to ensure JupyterLab file browser matches clone target

Git Clone Script (runtime/hub/core/scripts/git-clone.sh)

• Shell script for init container: validates env vars, runs git clone --depth 1 with optional branch, respects timeout
• Removes leftover clone directory from previous sessions (handles skipped preStop hooks)

Git Repo Validation (runtime/hub/core/handlers.py)

• New ValidateRepoHandler at /hub/api/validate-repo — validates repo URL and optional branch via dulwich.porcelain.ls_remote
• Pure Python validation (no subprocess), checks both refs/heads/ and refs/tags/ for branch existence
• 10-second timeout, async via run_in_executor
• dulwich added to requirements.txt

GitSpawnHandler (runtime/hub/core/handlers.py)

• New /hub/git/<provider/owner/repo> URL handler for direct repo spawning
• Validates provider against allowlist, supports ?autostart=1&resource=<key>&accelerator=<key> query params
• Returns allowedGitProviders in Resources API response
• Groups sorting: CUSTOM REPO and OTHERS pinned to bottom
• Quota API returns graceful disabled response when QuotaManager is not initialized

Configuration (runtime/hub/core/config.py, runtime/values.yaml, runtime/chart/values.schema.yaml)

• Add GitCloneSettings model (initContainerImage, allowedProviders, maxCloneTimeout)
• Add allowGitClone flag per resource metadata
• Add custom.gitClone section in values schema
• Config defaults deduplicated — setup.py delegates to RemoteLabKubeSpawner.configure_from_config()
• GPU resource default image updated to ghcr.io/amdresearch/base-gfx1151:v0.1-full

Spawn UI (runtime/hub/frontend/apps/spawn/)

• Git URL input as resource card sub-option — rendered inside the selected resource card, same level as GPU node selector
• Smart URL normalization: auto-prepend https://, extract branch from /tree/<branch>, strip .git
• Real-time repo validation via dulwich ls-remote API (debounced 800ms), with branch existence check
• Validating state indicator ("Checking repository..."), Launch button blocked during validation
• Branch detection hint display
• Git Repo badge on resource cards that support cloning
• Shareable /hub/git/ link generation with resource and accelerator params
• Auto-select resource and auto-submit via URL params (?autostart=1)
• Accordion behavior: only one category group expanded at a time
• Collapsing a category clears selection if the selected resource is in that group
• Basic resources (cpu, gpu) moved to dedicated CUSTOM REPO group (pinned to bottom)
• Shared validateRepo() API function in @auplc/shared package

Cleanup

• Removed 1196-line inline spawn UI fallback from resource_options_form.html (reverted to React bundle loader)

Configuration

Git Clone Settings (runtime/values.yaml)

custom:
  gitClone:
    initContainerImage: "alpine/git:2.47.2"
    allowedProviders:
      - github.com
      - gitlab.com
      - bitbucket.org
    maxCloneTimeout: 300

Per-Resource allowGitClone Flag

custom:
  resources:
    metadata:
      cpu:
        group: "CUSTOM REPO"
        allowGitClone: true   # Show git URL input on spawn form
      Course-CV:
        group: "COURSE"
        allowGitClone: false  # Course already has its own content

Testing

• Clone public repo via spawn form, verify repo appears in JupyterLab
• Stop session, verify cloned directory is cleaned up (preStop hook)
• Test /hub/git/github.com/owner/repo URL redirect
• Test ?autostart=1 auto-submit flow
• Test branch extraction from /tree/<branch> URLs
• Test URL validation against allowed providers
• Test shareable link generation and copy
• Test leftover directory cleanup (handles force-deleted pods)
• Test quota API with quota disabled
• Test category collapse clears selection
• Test accordion behavior (single group expanded)
• Test dulwich ls-remote validation (valid repo, invalid repo, valid branch, invalid branch)
• Test Git URL input as sub-option inside resource card
• Verified on Kubernetes cluster

Checklist

• Code follows project style guidelines (ruff format)
• Changes are backward compatible
• Tested on Kubernetes cluster