Cloud and self-hosted runners verify and repair the git origin URL

What

When Claude Code runs on your repository on a remote machine, it first clones the repository with git. The origin URL (remote.origin.url) is the address git saves for where the repository came from. This release adds checks around that address:

• BYOC cloud runner: it now checks and corrects remote.origin.url in the clone's settings, retrying if needed, and reports "Could not read remote.origin.url" when it cannot. Before, it ran git remote set-url origin <authURL> and fetched from origin.
• Separate fetch remote: when the origin URL differs from the auth URL (the address carrying access credentials), the runner fetches through a temporary named remote and passes the auth URL with git's -c config option.
• Governed git: after preparation, it reads remote.origin.url and logs when it is not the upstream URL.
• Fetch refspec: the cleaned-up .git config now uses a shared fetch refspec constant. A refspec is the rule for which branches are fetched. Before, +refs/heads/*:refs/remotes/origin/* was written in directly.
• Git helpers: git failures now record exitCode and wroteStderr, and the helper that starts git can capture its standard output.

Why

The address saved in the clone is now checked against what it should be, and corrected or logged when it is wrong. Credentials for fetching are passed separately instead of being written in as the origin. Failed git commands also leave more detail behind for diagnosis.