[Initiative] Remove git binary shell-outs from gitstore-git-service

[juliuskrah]

Summary

Remove shell-out usage of the git binary from gitstore-git-service and eliminate the runtime git package dependency from docker/git-service.Dockerfile. All supported Git smart HTTP operations should execute in-process.

Current shell-outs exist in gitstore-git-service/src/http_git_server.rs for:

• git upload-pack --advertise-refs
• git receive-pack --advertise-refs
• git upload-pack --stateless-rpc
• git receive-pack --stateless-rpc

Scope

In Scope

• Replace all std::process::Command::new("git") call sites in gitstore-git-service with in-process implementations.
• Remove the runtime git package installation from docker/git-service.Dockerfile.
• Ensure HTTP smart protocol clone/fetch/push still works end-to-end after the migration.
• Keep error reporting and status propagation compatible with current client expectations.
• Add integration coverage proving the git-service image works without the git binary present.

Out of Scope

• Implementing SSH transport.
• Validation/admission policy semantics themselves.
• Proxy or ingress changes.

Acceptance Criteria

• No Command::new("git") or equivalent shell-out remains in gitstore-git-service production code.
• The runtime gitstore-git-service container image does not install the git package.
• git clone, git fetch, and git push over the supported HTTP transport still succeed in automated integration tests.
• Error responses for push rejection remain human-readable and compatible with existing workflows.
• CI includes a test path that proves the service operates without the git binary available.

Dependencies

• Depends on: [Initiative] Migrate gitstore-git-service from git2 to gitoxide #108 ([Initiative] Migrate gitstore-git-service from git2 to gitoxide)
• Supports: [Initiative] Decouple API from Git Storage via gRPC Git Service #65 ([Initiative] Decouple API from Git Storage via gRPC Git Service)

Tracking

• Milestone: TBD