--clone drops the source checkout's repo-local git identity — propagate the effective user.* into the clone (companion to #429) #438

Summary

#429 propagates the host-global git config user.name/user.email into the guest. But a common setup keeps identity repo-local — different emails per forge (a GitHub noreply address for GitHub remotes, a GitLab-verified address for a self-managed instance) make a single global value wrong by construction, so user.* lives in each checkout's .git/config. A --clone workspace is a true clone: .git/config doesn't survive, the global tier is empty, and the first in-sandbox commit dies with Author identity unknown (agent@<sandbox>.(none)).

Repro

1. On the host, a repo with user.name/user.email set repo-locally and no --global identity.
2. acq create --clone … with that repo as primary (msb backend).
3. In the sandbox: git commit → Author identity unknown, while the same commit works on the host.

Why the kit/doc layer can't fix it well

A team kit can't carry personal values, and deriving identity in-guest from the forge API isn't generally possible (in our environment the GitLab API is WAF-gated by egress network and unreachable from msb sandboxes, while git endpoints work). The information already exists in exactly one reliable place: the source checkout acq is cloning.

Proposed fix

At --clone setup time, read the effective identity from the source checkout on the host — git -C <src> config --get user.name / --get user.email, which resolves local + includeIf + global exactly as the user's own commits would — and write it repo-locally into the scratch clone, skipping any value already set (so kit or manual overrides win). This composes with #429: global-tier propagation covers the no-repo-local case; this covers the rest. sbx's native --clone copies .git wholesale and carries identity incidentally today, so doing this in the neutral clone path also keeps the two backends' behavior aligned (ADR-0027's divergence list shrinks by one).

Precedent: VS Code Dev Containers copies host git user info into the container; Codespaces and Gitpod set user.name/user.email from the account. Propagating only the two inert user.* values is the minimized form of what sbx's wholesale .git copy already does — and avoids what makes the wholesale copy risky (credential helpers, hooks, URL rewrites riding along).