M4 epic: Git source and GitHub bootstrap

[Andreas-Froyland]

Tracking issue. Dependency and status checklists only — implementation stays in narrow linked issues.

Outcome

An optional Git repository is the canonical source of versioned desired resources, validated before activation.

Supersedes

Replaces the "separate data repo as declarative source of truth" portion of #2.

Depends on

• M4 desired resource schema and composition
• FM-102 — encrypted controller secret records (M1)

Scope checklist

• Isolated clone/worktree validation before activation
• Revision history, conflict reporting, and manual rollback
• An invalid revision never replaces the last valid active revision
• GitHub App web flow for one-click private repository creation with least permissions and expiring tokens

Constrained by

• docs/PLAN.md — M4; ADR-0004
• Status and secrets are forbidden in Fleet Git

Non-goals

• Auto-resolving semantic Git conflicts
• Writing observed state back to the repository