feat(git): thin project onboarding, provider integration, and AgentOS repository access

Effect primitives:
- git-provider: GitProvider, connection states, normalized errors, URL
  normalization, host compatibility, credential freshness window
- git-provisioning: validated Puter commands, migration states, idempotency
  keys, safe replacement rules, owner-safe guards
- git-webhook: supported events, signature verification, delivery states
- host-repository: provider-neutral credential-safe clone via GIT_ASKPASS

Normalized Convex schema:
- gitProviderAccounts, refined gitConnections, gitProviderOrganizations,
  gitRepositories, gitMigrations, gitWebhookDeliveries
- projects: gitRepositoryId + instructions fields
- Schema fields optional for backward compatibility, with backfill cron

Backend:
- Connection health: verify action, hourly reconciliation (covers stale
  active + reauth-required + undefined-state legacy connections)
- Puter provisioning: createPuterUser/Organization/Repository with owner
  binding, startGithubMigration (durable via scheduler), getMigration
- Org ownership: explicit member add with admin role + verification
- Webhook HTTP actions: HMAC verification, delivery persistence with
  idempotency, repository resolution, byte-length payload limit
- Automatic Puter webhook creation after repo creation/migration with
  fail-loud state tracking
- Repository sync after connection (Gitea + GitHub)
- AgentOS execution resolves gitRepositoryId for real clone URL
- Credential gating: state + freshness checks before execution and
  project creation
- listForOrganization for cross-project Work filtering

Frontend:
- /projects onboarding page with GitHub OAuth (linkSocial) and Puter PAT
- Zero-project redirect, repository selection, context editor
- Provider-aware settings panel (no serverUrl for Puter)
- Project selection via ?project= query param
- GitHub scopes: repo + read:org

Agent runtime:
- Clones user repository with GIT_ASKPASS credential helper (no token in
  URL, args, or git config), provider-aware username
- Removed fixed Zopu source path and .env copy

package.json

@@ -1,6 +1,53 @@
 {
   "name": "code",
   "private": true,
+  "workspaces": {
+    "packages": [
+      "apps/web",
+      "packages/agents",
+      "packages/auth",
+      "packages/backend",
+      "packages/config",
+      "packages/env",
+      "packages/primitives",
+      "packages/ui"
+    ],
+    "catalog": {
+      "@rivet-dev/agentos": "0.2.14",
+      "@rivet-dev/agentos-core": "0.2.14",
+      "@effect/platform-bun": "4.0.0-beta.99",
+      "dotenv": "17.4.2",
+      "zod": "4.4.3",
+      "lucide-react": "1.27.0",
+      "next-themes": "0.4.6",
+      "react": "19.2.8",
+      "react-dom": "19.2.8",
+      "sonner": "2.0.7",
+      "convex": "1.42.3",
+      "better-auth": "1.6.15",
+      "@convex-dev/better-auth": "0.12.5",
+      "@tanstack/react-form": "1.33.2",
+      "@types/react-dom": "19.2.3",
+      "tailwindcss": "4.3.3",
+      "tailwind-merge": "3.6.0",
+      "@better-auth/expo": "1.6.15",
+      "effect": "4.0.0-beta.99",
+      "typescript": "7.0.2",
+      "@types/bun": "1.3.14",
+      "heroui-native": "1.0.6",
+      "vite": "8.1.5",
+      "vitest": "4.1.10",
+      "convex-test": "0.0.54",
+      "react-native": "0.86.0",
+      "@types/react": "19.2.17",
+      "@types/node": "22.20.1",
+      "hono": "4.12.32",
+      "valibot": "1.4.2",
+      "streamdown": "2.5.0",
+      "@tailwindcss/postcss": "4.3.3",
+      "@tailwindcss/vite": "4.3.3"
+    }
+  },
   "type": "module",
   "scripts": {
     "dev": "vp run -r dev",
@@ -41,5 +88,10 @@
     "vite-plus": "0.2.2",
     "vitest": "catalog:"
   },
+  "overrides": {
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "vite": "npm:@voidzero-dev/vite-plus-core@0.2.2"
+  },
   "packageManager": "pnpm@11.17.0"
 }