Report daemon loaded repos to server (populate MachineRepo)

[pulzzejason]

Problem

The Machines page (#143, merged) reads the MachineRepo table to show which repos a machine has loaded, but nothing writes those rows. T125 (pr#450) clones/reconciles repos into /workspace and tracks them in a container-local cloned.json, but never reports them to the server — so #143's "Loaded repos" section is permanently empty. This is the missing bridge.

Task: #146 (report-daemon-loaded-repos-to-server-populate-machinerepo)

Approach

Piggyback the loaded-repo list onto the existing heartbeat (PATCH /api/v1/me/machines/[id]/heartbeat, called every 30s; T125 already computes the cloned-set) → server reconciles MachineRepo (upsert reported, delete absent), owner-scoped + zod-validated.

Acceptance criteria

• Daemon reports its current loaded repos (repo, optional branch, path) each cycle.
• Server reconciles MachineRepo for the machine: upsert reported, delete no-longer-reported; owner-scoped via authorizeDaemonOrSession + userId.
• Report body zod-validated (repo slug regex + length caps); invalid → 422, no partial write.
• Heartbeat with no body still works (back-compat).
• After T125 clones a repo it appears in the feat: peter-current-working-branch-2 #143 drill-in within one cycle; removal clears it within one cycle.
• Reporting is best-effort — failure logs + retries, never crashes the loop.

Phases

1. Server — extend heartbeat endpoint to accept/reconcile loadedRepos + integration tests.
2. Daemon — send the cloned-set on heartbeat (stacks on T125) + unit test.

Dependencies

• feat: peter-current-working-branch-2 #143 (merged) — MachineRepo model + read endpoint + UI.
• T125 (pr#450) — provides the cloned-set; Phase 2 stacks on it. Phase 1 (server) is independent and buildable now.

Security

Extends an authed endpoint (keep owner-scoping; test non-owner rejection). No secrets. Untrusted input (daemon-reported list) → zod slug regex ^[a-zA-Z0-9][\w.-]*/[a-zA-Z0-9][\w.-]*$ + length caps before any write.

Rollback

Revert; heartbeat falls back to bodyless, MachineRepo stops being written (UI → empty state). No schema change to undo.

Full spec: .tasks/.data/tasks/report-daemon-loaded-repos-to-server-populate-machinerepo.md