fix(core): close contract edges in git/repomanager/workspace/targethasher (audit #14)

[sbalabanov]

Summary

Four methods on git.Interface (RevParse, IsAncestor, GetCommitTimeSecond, FileHashes) bypassed the timeout and wrapError path, so fatal git exits never surfaced as ErrFatal and the orchestrator could not classify them. Additionally, repomanager.Lease only wrapped ErrPoolTimeout for deadline exceeded (not plain cancellation), workspace.Release was not idempotent (double-release corrupted the pool), and targethasher's directory walk ignored context cancellation.

• (a) git wrapping: Route all four methods through _gitTimeout + wrapError, preserving IsAncestor's exit-code-1 → (false, nil) semantics.
• (b) ErrPoolTimeout: Wrap ErrPoolTimeout on both context.Canceled and context.DeadlineExceeded, matching the sentinel's godoc.
• (c) Release idempotency: Guard workspace.Release with sync.Once so the onRelease callback fires exactly once.
• (d) targethasher cancellation: Thread context.Context into hashDir and check ctx.Err() every cancelCheckInterval files.

Test plan

• TestFatalExitCode_wrapsErrFatal — table-driven: fatal exit 128 from each of the four methods yields errors.Is(err, ErrFatal)
• TestLease_CtxCanceled — updated: plain cancellation now asserts errors.Is(err, ErrPoolTimeout)
• TestWorkspace_Release_Idempotent — channel-based: two Release calls, assert callback channel has exactly one entry
• TestHashDir_RespectsCtxCancellation — pre-cancelled ctx with >cancelCheckInterval files, assert errors.Is(err, context.Canceled)
• All existing tests pass (go test ./core/... ./orchestrator/ ./controller/ ./graphrunner/ ./mapper/)

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sbalabanov]

This draft has been split into three independent, focused replacement PRs based on the latest main:

• fix(git): apply timeout and fatal-error wrapping consistently (audit #14.1) #267 - Audit surface the panic error to client #14.1: consistent Git timeout and fatal-error wrapping
• fix(workspace): make Release idempotent (audit #14.2) #268 - Audit surface the panic error to client #14.2: idempotent workspace release
• fix(targethasher): make directory hashing cancellation-aware (audit #14.3) #269 - Audit surface the panic error to client #14.3: cancellation-aware source-directory hashing

The repomanager cancellation reclassification from this draft was intentionally not carried forward because mapping plain context.Canceled to ErrPoolTimeout would also change orchestrator retry semantics. That behavior should be proposed separately if desired.

Closing #262 as superseded by the PRs above.