nisse-review: read code from a git clone kept between runs

Archives were downloaded and unpacked afresh for every run, which doesn't
scale to very large repositories. Each repository is now cloned once, with
its whole history, under scratch/repos/<owner>/<name>/ (head/ the clone,
base/ a worktree when read). A run fetches every branch and the PR's
refs/pull/N/head, checks out the head exactly, and fails if that head is
gone. Only the latest repository is kept for now.

Git runs walled off: none of the host's git configuration, links checked
out as plain files, no hooks, submodules or LFS, only the Gitea URL's
protocol, and the token as an http.extraHeader for that URL in git's
environment only. A stop ends a git command; a cut-short first clone is
removed. The reader never shows .git. GiteaClient.archive is gone.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review/src/nisse_review/build.py

@@ -2,7 +2,6 @@
 before it reviews anything."""
 
 from dataclasses import dataclass
-from pathlib import Path
 
 from nisse_core.gitea import GiteaClient
 from nisse_core.knowledge.handlers import Knowledge
@@ -17,6 +16,7 @@ from nisse_core.models.llm import LiteLLMClient
 from nisse_core.oplog import OpLog
 from nisse_core.state.cancel import Cancel
 from nisse_review.access import AccessRefused, check, reviewed
+from nisse_review.clones import Clones
 from nisse_review.config import ReviewConfig
 from nisse_review.review import Reviewer
 from nisse_review.scheduler import Scheduler
@@ -142,14 +142,20 @@ def build(
         max_turns=tuning.review.max_turns,
         diff_chars=tuning.review.diff_chars,
     )
-    scratch = config.state_db.parent / "scratch"
-    scratch.mkdir(exist_ok=True)
+    # The repositories' clones, kept between runs (R3).
+    clones = Clones(
+        config.state_db.parent / "scratch" / "repos",
+        config.gitea_url,
+        config.gitea_token,
+        oplog=oplog,
+        cancel=cancel,
+    )
     scheduler = Scheduler(
         store,
         gitea,
         reviewer,
         oplog=oplog,
-        scratch=Path(scratch),
+        sources=clones,
         poll_s=tuning.review.poll_s,
         attempts=tuning.review.attempts,
         ci_wait_s=tuning.review.ci_wait_s,