Implement clone and receive-pack plumbing parity slice

[Ismail-elkorchi]

Acceptance Criteria

• local Repo.clone MUST materialize the selected branch tree and match git clone --branch head/worktree parity for local sources.
• receive-pack plumbing MUST provide pkt-line request generation and advertised ref capability lines and guarded ref update semantics.
• the parity and API documentation MUST include the new clone/receive-pack family in partial state with explicit test evidence.

Checklist

• Added Repo.clone with local branch selection and unsupported-option guards for depth/filter/submodules.
• Added receivePackRequest, receivePackAdvertiseRefs, and receivePackUpdate API methods.
• Added src/core/network/receive-pack.ts pkt-line helpers.
• Added node parity tests for clone branch selection and receive-pack plumbing behavior.
• Updated docs/api.md, docs/parity-matrix.md, and spec/parity-roadmap.yaml.
• Ran node scripts/check --runtime=node successfully.

Simulated Role Reviews

Product review

Findings:

• Clone branch selection now yields the same checked out commit and worktree payload as baseline git local clone.
• Receive-pack plumbing exposes a minimal, composable API surface without changing unrelated command families.
  Changes made:
• Added clone branch option handling and commit-tree materialization in src/index.ts.
• Added receive-pack request/advertisement/update methods in src/index.ts with lock-guarded update behavior.
  Evidence pointers:
• tests/node/clone-receive-pack.test.mjs
• docs/api.md

QA review

Findings:

• New tests cover both success paths and stale-old-oid rejection for receive-pack updates.
• Clone parity test validates git fsck and branch head equivalence to reduce false parity confidence.
  Changes made:
• Implemented clone local branch selection keeps parity with git clone INV-FEAT-0053 test.
• Implemented receive-pack plumbing builds pkt-lines and applies guarded ref updates INV-FEAT-0053 test.
  Evidence pointers:
• tests/node/clone-receive-pack.test.mjs
• node scripts/check --runtime=node

Security review

Findings:

• Receive-pack update path validates oid formats and enforces optimistic-lock behavior before ref mutation.
• Clone keeps existing path-safety behavior by materializing through repository object content and checkout path guards.
  Changes made:
• Added oid length and format validation in receive-pack request/update methods.
• Added guarded mismatch error path using LOCK_CONFLICT for stale updates.
  Evidence pointers:
• src/index.ts
• src/core/network/receive-pack.ts

Performance review

Findings:

• Advertisement generation now preserves caller order while keeping capability dedup/sort deterministic.
• Clone materialization performs a single tree walk and blob read pass for selected commit content.
  Changes made:
• Added ordered receive-pack advertisement builder.
• Added recursive tree materialization logic scoped to selected head commit.
  Evidence pointers:
• src/core/network/receive-pack.ts
• src/index.ts

Maintainer review

Findings:

• Changes remain localized to network plumbing, clone API, docs, and parity tests.
• Parity roadmap and matrix now track this family explicitly as partial, matching implementation maturity.
  Changes made:
• Added new core module src/core/network/receive-pack.ts and wired imports.
• Updated parity tracking docs with clone/receive-pack family entry.
  Evidence pointers:
• docs/parity-matrix.md
• spec/parity-roadmap.yaml