fix(providers/git): observe quarantine remotes read-only

Checkout quarantine only needs ls-remote to prove the head is published,
so gating it on the push URL blocked SSH and HTTPS remotes entirely.
Validate the fetch URL for observation instead and permit the credential
-free https/ssh transports for the read while push stays gated.

Author: rldyourmnd

core/providers/git/handoff.go

@@ -362,7 +362,10 @@ func (runner *MutationRunner) observeRemoteRef(
 ) (string, error) {
 	result, err := runner.runWithEnvironment(
 		ctx, root, map[int]struct{}{0: {}}, nil,
-		"-c", "protocol.allow=never", "-c", "protocol.file.allow=always",
+		"-c", "protocol.allow=never",
+		"-c", "protocol.file.allow=always",
+		"-c", "protocol.https.allow=always",
+		"-c", "protocol.ssh.allow=always",
 		"ls-remote", "--refs", remoteURL, remoteRef,
 	)
 	if err != nil {

core/providers/git/quarantine.go

@@ -168,7 +168,11 @@ func (runner *MutationRunner) observeCheckoutForQuarantine(
 		status.Worktrees[0].Locked || status.Worktrees[0].Prunable {
 		return CheckoutQuarantineEvidence{}, errors.New("checkout is not clean, current, and exclusive")
 	}
-	remoteURL, err := runner.validatedPushURL(ctx, physical, "origin")
+	// Quarantine only reads the remote (ls-remote below) to prove the checkout's
+	// commits are published; it never pushes. The fetch-side URL is therefore
+	// the right one to observe and network transports are allowed — the
+	// mutation-only gate (validatedPushURL) does not apply to a read.
+	_, remoteURL, err := runner.validatedRemoteURL(ctx, physical, "origin")
 	if err != nil {
 		return CheckoutQuarantineEvidence{}, err
 	}

core/providers/git/quarantine_test.go

@@ -3,6 +3,7 @@ package git
 import (
 	"context"
 	"crypto/sha256"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -75,3 +76,45 @@ func TestQuarantineCheckoutPreservesDirtyRepository(t *testing.T) {
 		t.Fatalf("dirty work changed: %q %v", content, err)
 	}
 }
+
+func TestQuarantineRemoteValidationAdmitsNetworkTransportsForReadOnlyObservation(t *testing.T) {
+	client, _ := mutationRepository(t)
+	runFetchGit(t, client, "remote", "add", "origin", "git@github.com:example/repository.git")
+	runner, err := NewMutationRunner()
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, url, err := runner.validatedRemoteURL(context.Background(), client, "origin")
+	if err != nil {
+		t.Fatalf("read-only observation must admit the fetch URL: %v", err)
+	}
+	if url != "git@github.com:example/repository.git" {
+		t.Fatalf("url=%q", url)
+	}
+	if _, err := runner.validatedPushURL(context.Background(), client, "origin"); !errors.Is(err, ErrNetworkMutationDisabled) {
+		t.Fatalf("push URL must remain mutation-gated: %v", err)
+	}
+}
+
+func TestQuarantineCheckoutNetworkRemoteFailsAtObservationNotAtTheMutationGate(t *testing.T) {
+	fixture := fastForwardFixture(t)
+	runFetchGit(t, fixture.client, "remote", "set-url", "origin", "ssh://127.0.0.1:1/repository.git")
+	head := stringsTrim(runFetchGit(t, fixture.client, "rev-parse", "HEAD"))
+	workspaceRoot := filepath.Dir(fixture.client)
+	stateRoot := t.TempDir()
+	quarantine := filepath.Join(stateRoot, "quarantine", "checkouts", "repo_fixture", head)
+	runner, err := NewMutationRunner()
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = runner.QuarantineCheckout(
+		context.Background(), workspaceRoot, fixture.client, stateRoot, quarantine,
+		head, "refs/heads/main", fmt.Sprintf("sha256:%x", sha256.Sum256([]byte("x"))),
+	)
+	if err == nil {
+		t.Fatal("an unreachable remote must fail the observation")
+	}
+	if errors.Is(err, ErrNetworkMutationDisabled) {
+		t.Fatalf("read-only remote observation must not hit the mutation gate: %v", err)
+	}
+}