feat: add layered context sources

[shivros]

Summary

Implements Linear issue COD-407.

• Compose ordered organization git layers with local per-repository .creed/ context.
• Route sync, diff, validate, doctor, list, watch, and pull through one source-resolution path.
• Preserve local context during pull and reject layered push to prevent clobbering.
• Add ref-aware git caching, HTTPS/SSH auth handling, path containment, credential redaction, and per-layer validation.
• Add migration documentation, OpenSpec artifacts, and regression coverage.

Verification

• go test -race -count=1 ./...
• go build ./...
• go vet ./...
• gofmt -l .
• scripts/check-generated.sh
• Live layered CLI check: sync exit 0; drifted diff exit 1.
• Public GitHub HTTPS layered validation passed.

Risk / rollout

• Existing local and direct git manifests remain supported.
• Layered consumers should pin shared refs to commit SHAs for reproducible CI.
• No generated interaction-surface changes were required.

Exclusions

• No automatic merge or release.
• SSH authentication was not live-tested on this host because no SSH agent was available; existing SSH auth-path tests pass.

[shivros]

🤖 Automated Review Panel

Panel run retroactively on request — this PR was opened outside the runner workflow (branch feat/layered-context-sources, COD-407), so it did not receive the standard pre-open review.

GPT-5.6-terra (openai/gpt-5.6-terra)

Changes requested.

• [Major] internal/adapters/gitremote/source.go (clone) — Ref support does not correctly fetch non-default branch commits. For any non-empty ref, the code resolves the desired SHA, but PlainCloneContext is still invoked without ReferenceName/a refspec and therefore clones only the remote's default branch (Depth: 0). Checkout will fail for a commit reachable only from a non-default branch. This contradicts the documented contract that ref may be a branch, tag, or commit SHA, and makes a common pinned-org-layer configuration unreliable. Fetch the requested branch/ref explicitly (and verify SHA existence) before checkout.
• [Major] internal/adapters/gitremote/source.go (resolveRemoteRef/clone) — A full 40-character SHA is accepted without confirming it exists in the remote advertisement, and the subsequent default-branch clone may not contain it. The implementation cannot reliably support the migration guide's recommended "full commit SHA" pins when the commit is not on the default branch or reachable only through another ref. Resolve/fetch the requested object/ref rather than treating syntactic SHA validity as remote validity.
• [Major] Acceptance/auth verification not substantiated — source_test.go adds only local filesystem Git fixtures; layered_test.go likewise uses local repositories. No HTTPS-token auth test against GitHub, no SSH-agent/key test against GitHub, and no layered-path test exercising either auth mode. The PR body says SSH was not live-tested, while COD-407 requires both SSH-agent and HTTPS-token paths verified against github.com. Add an authenticated integration test strategy (likely opt-in/CI-secret-backed) or do not claim this acceptance criterion is complete.
• [Minor] docs/layered-context-migration.md — Promises ref "may pin a branch, tag reference, or commit SHA" and recommends SHA pins, but the fetch behavior above does not uphold that promise for all valid remote refs. Docs shouldn't merge as-is until ref resolution is correct.

Gemini 3 Flash (google/gemini-3-flash-preview)

Approved. The PR implements the layered context architecture requested in COD-407, centralizing source resolution across all CLI operations while maintaining security boundaries.

• [Critical→positive] Credential redaction (service/doctor.go: redactRemoteURL) — Correctly drops the entire User object (username and password); CI usernames are often themselves bearer tokens.
• [Major→positive] Path containment (localfs/source.go: readContainedFile) — /proc/self/fd validation prevents TOCTOU symlink attacks during Open.
• [Major→positive] Pull behavior (service/impl.go: ensureLayeredManifest) — Merge-or-insert for the org layer avoids duplicate layers across repeated pulls.
• [Minor] Git ref resolution (resolveRemoteRef) — Prioritizes branches over tags on ambiguity and handles peeled tags (^{}) correctly. Note: terra disagrees on this exact code — see its Major findings on non-default-branch fetch.
• Verified: Sync/Diff/Validate all route through openSource (layered context respected in CI gating); Push blocked for layered sources; normalizePullRemoteURL rejects embedded credentials; cacheKey includes ref.

---

Panel summary: split verdict. Gemini approves; terra blocks on git-ref fetch correctness (non-default-branch/SHA-pin clones) and unsubstantiated auth acceptance criteria. The ref-fetch finding is the substantive one — resolve before merge.

[shivros]

Automated review follow-up

Addressed in commit bd6b973 (rebased on the remote staticcheck cleanup ae5530a):

• Non-default branch refs: ref clones now explicitly fetch the resolved branch/tag/SHA into refs/creed/pinned before checkout, with an all-heads/tags fallback for servers that reject exact-SHA refspecs.
• Full SHA pins: the SHA is resolved from the remote ref advertisement/fetch path rather than assumed reachable from the default branch.
• Regression coverage: added TestGitRemoteNonDefaultBranchAndSHARefs for a commit reachable only from a feature branch, testing both branch-name and full-SHA refs. Annotated-tag coverage remains in TestGitRemoteAnnotatedTagRef.
• Auth acceptance strategy: added opt-in TestLayeredGitHubAuthIntegration, using CREED_GITHUB_HTTPS_REMOTE + CREED_GITHUB_HTTPS_TOKEN and/or CREED_GITHUB_SSH_REMOTE. The HTTPS-token layered leg was executed successfully against github.com/TechGodHQ/agent-context; the SSH leg requires a runner/user SSH agent or key and is intentionally not enabled on this host.
• Docs: the migration guide now documents the opt-in credential-backed integration test variables.

Local verification after the update: go test -race -count=1 ./..., go build ./..., go vet ./..., gofmt, and generated-code checks all pass.