[sergeyfast]

Why

A mirror was cloned in place, and "HEAD exists" meant "the mirror exists". On one instance with little memory, clones were OOM-killed and cut off by the 5-minute timeout again and again. Nothing cleaned up after them: the mirror of a 0.85 GB repository grew to 65 GB of packs with no HEAD. After that every cron tick failed with destination path already exists and is not an empty directory, and the mirror stayed broken until someone removed it by hand.

What changed

• Clone into .clone-<name>-*, then rename into place after the first fetch. A clone that fails or is killed leaves no directory that looks like a mirror.
• Junk without HEAD at the mirror path is removed before cloning, so mirrors broken by earlier versions heal on their own. Only a missing HEAD counts; a stat error is returned.
• repairConfig runs on every Ensure. It scrubs a token from the remote URL and restores a missing fetch refspec, and writes the config through a rename.
• The whole process group is killed on cancel (pkg/client/proc), for git and for the AST engine, whose npm install is a node shim around the binary. Before, helpers kept writing and held the pipes, so Run outlived its deadline by minutes.
• The first clone gets its own 30-minute CloneTimeout, and at most 2 clones run at a time. once() lets work outlive a caller that gave up, so the cron limit bounded waiting, not cloning.
• Prune removes .clone-* directories and objects/pack/tmp_* files that have been untouched longer than a clone plus its fetch, regardless of the disk budget. Removals are reported through Options.OnRemove and logged as storage removed.
• A new git.ErrCloning is returned when the caller stops waiting for a clone that is still running. Cron logs it as mirror still cloning, and tools answer Timeout with a hint to retry instead of Upstream.

Tests

• 8 new tests. On the old code they fail as expected: the clone into junk fails with the same error seen in production, and Run hangs for 60 s after cancel.
• go test ./... and -race on the touched packages pass, golangci-lint: 0 issues.
• Builds for darwin, linux and windows.

Rollout notes

• Existing mirrors are untouched: a config that already has the refspec is not rewritten.
• On rollback to v0.0.3, leftover .clone-* directories are not cleaned by the old code; remove them by hand.