Live-host validation pending: Gitea promisor verdict + GitHub smoke (OP3)

[badnikhil]

Category: validation gap (biggest gap before a trustworthy v1). DESIGN.md Section 18 open problem 3.

Problem

Everything is proven over file:// — the same git send-pack/receive-pack path, but not a real provider. Two things are written and env-gated but never run in this environment:

1. Gitea/Forgejo promisor-fetch verdict. Does partial-clone blob-by-OID fetch (DESIGN Section 10.3) work on Gitea/Forgejo, or does the read path fall back to full-segment fetch? The mechanism + probe + fallback are implemented (RemoteBackend::read_blob_at); the fallback means a negative verdict degrades performance, not correctness — but the verdict is unrecorded.
2. GitHub smoke test. Tiny put/get roundtrip against real private repos, observable rate-governor throttling, budget-wall refusal.

Testing status (per AGENTS.md)

No #[ignore]d failing test here: this is an external-dependency validation gap, not a defect. The tests already exist and skip cleanly when their env vars are unset (the right pattern for tests that need a live host):

GITSTORAGE_GITEA_URL=https://gitea.example.com GITSTORAGE_GITEA_OWNER=<owner> GITSTORAGE_TOKEN=<token> \
  cargo test --test backend gitea_live_roundtrip -- --nocapture
GITSTORAGE_GITHUB_OWNER=<owner> GITSTORAGE_TOKEN=<token> \
  cargo test --test backend github_live_smoke -- --nocapture

Record the Gitea promisor verdict in DESIGN.md Section 10.3 / Section 18 once run.

[badnikhil]

🎉 GitHub data plane validated LIVE (partial close)

Ran the real thing against github.com/badnikhil:

• init created two private repos (gs-vol0, gs-index) via the control-plane REST API.
• put chunked+encrypted a file and pushed it to GitHub; get pulled it back byte-identical. First live GitHub roundtrip. ✅

Bug found + fixed in the process (commit 7c9e807): the data-plane git-over-HTTPS auth used Authorization: Bearer <token>, which GitHub's git endpoint rejects (REST accepts it, so init worked, but every put/get failed with could not read Username ... terminal prompts disabled). Switched net_git + mirror_repo to HTTP Basic (base64("<token>:")), which git-over-HTTPS accepts on both GitHub and Gitea. Locked by a header-format unit test.

Still open: the Gitea promisor-fetch verdict (no Gitea instance available yet) and confirming GitHub's read path used the promisor (blob-by-OID) vs the full-segment fallback. Keeping this issue open for the Gitea side.