acq(msb): private GitHub repo clone (playbook kit) blocked by msb git-over-HTTPS secret substitution #203

Summary

On the msb backend, the agentic-coding-playbook kit's git clone of the
private GSA-TTS/agentic-coding-playbook repo is skipped: microsandbox 0.6.6
does not substitute the credential placeholder for git's HTTPS smart-transport
to github.com. The kit is non-fatal (warns and continues); every other msb
kit (usai-provider, git-ssh-sign, zscaler-ca-certificate) works, and the sbx
backend is unaffected.

This is the deferred item from the Phase 2 msb PR (see
docs/adr/0011-msb-backend-and-neutral-kits.md and
docs/BACKEND_GUIDE.md msb "Known limitations").

Evidence (verified on a KVM host, msb 0.6.6)

• msb does substitute the placeholder on an Authorization: Bearer header
  to api.gsa.usai.gov and api.github.com (USAi path returns a real status;
  a curl bearer to api.github.com returns an authenticated response).
• msb does not substitute for git's HTTPS clone to github.com: the request
  is blocked/unsubstituted regardless of:
  • request shape (info/refs GET with no body, or the git-upload-pack POST),
  • single vs multiple --secret bindings,
  • Authorization: Bearer $MSB_GITHUB_TOKEN header vs x-access-token:...@ URL,
  • HTTP/1.1 vs HTTP/2.
    Symptom: GnuTLS recv error (-110): TLS connection non-properly terminated
    or Empty reply from server (msb blocking the substitution), or a passthrough
    401 that makes git prompt for credentials.
• --tls-intercept is enabled (required for substitution) and the interception
  CA is trusted in the guest (plain HTTPS to github.com returns 200).

Upstream references

• git clone over HTTPS fails inside a sandbox when an SNI-matching secret is configured superradcompany/microsandbox#756 (git clone over HTTPS fails when an SNI-matching secret is
  configured) — closed by #768, but the symptom recurs on 0.6.6.
• Same-Placeholder Secret Conflict — Ineligible Entry Blocks Eligible Substitution superradcompany/microsandbox#1170 (Same-Placeholder Secret Conflict — ineligible entry blocks
  eligible substitution) — OPEN, filed against 0.6.6; binding the same
  GITHUB_TOKEN placeholder across multiple github hosts triggers this.

What acq does today

• Does not bind a GitHub --secret on msb (avoids #1170 and the git block).
• Stores the GitHub token in the acq secret store for the sbx backend, which
  injects it transparently via its proxy (playbook clone works on sbx).
• msb playbook kit warns and the sandbox comes up fully usable otherwise.

Resolution / triggers to pick this up

• Re-test when a microsandbox release fixes git-over-HTTPS substitution
  (watch #756/#1170), then have the msb adapter bind GITHUB_TOKEN for the
  github hosts + configure the guest git clone to carry the placeholder header.
• OR make the playbook repo readable without auth (public), which removes the
  need entirely.
• OR ship a base image with the playbook pre-cloned.

Workarounds for users now

• Use the sbx backend for the playbook kit.
• Set ACQ_MSB_IMAGE to a base with the playbook pre-cloned.

AI-assisted (OpenCode). Deferred from the Phase 2 msb backend PR.