[wcgomes]

Summary

• Replace one-shot guest Git credential seeding and the refresh-credentials command with automatic, on-demand host-provider acquisition over private exec/socket channels. Prepare or repair connections before lifecycle hooks and in-container cloning; retain destination authorization, rejection handling, and Azure URL/path behavior without guest token stores.
• Start the same CLI as a detached, per-user broker on demand. It survives CLI exit, reuses only matching executable identity, gracefully replaces older owners, exits after five seconds without demand, and recovers after a crash only on the next lifecycle activation. No launchd job, plist, sudo, Homebrew service, or automatic crash restart.
• Include checksum-pinned static Linux arm64/amd64 relay builds, generated/ignored embedded Swift assets, artifact checks, CI preparation, release packaging, and third-party notices. Runtime installation needs no guest compiler or extra package.
• Update README/contributor/smoke documentation and core/clone contracts; preserve the archived automatic-credentials, idle-shutdown, and detached-lifecycle specifications. Unrelated local wiki changes are deliberately excluded.

Verification — previously executed, not rerun for this Git/PR operation

The archived execution record contains the reviewed evidence:
specs/changes/archive/20261022-git-broker-detached-lifecycle/tasks.md.

• Debug CLI/test products and release CLI product built successfully. Pre-existing compiler/linker warnings remain; no zero-warning claim.
• Synthetic suite: 1202 passed, 0 failed, 0 skipped; all 18 live integration cases excluded.
• Credential-focused suite with explicit detached probe gate: 113 passed, 0 failed, 0 skipped. Covers CLI-exit survival, concurrent singleton activation, idle shutdown, identity-based replacement, fail-closed endpoints, crash containment, next-start recovery, and owned cleanup.
• Separately authorized real plantsuite smoke: 7/7 git ls-remote, 8/8 credential gets, concurrent 8 gets + 4 Git operations in 1.838s; broker PID survived CLI exit. Stop plus idle exit completed in 5.642s total. Following an injected crash, 8.104s observation showed no automatic respawn; lookup missed as expected and the next start restored the connection. Reviewed cleanup confirmed plantsuite stopped, no remaining broker or LaunchAgent, restored files, unchanged credential-store metadata, and removal only of owned smoke artifacts; recovery backups preserved.
• This operation performed Git status/diff/index checks and a staged heuristic secret scan; it did not rerun builds or runtime tests.

Limits

• Real external-stop retirement within nine seconds is not certified; combined stop-and-idle timing is not isolated idle latency.
• OAuth renewal was not forced or proved. A successful lookup or unchanged token is not evidence of renewal.
• Live full-suite integration was not rerun; no claim of full live-suite coverage. Detached probes remain opt-in and are not enabled by CI.
• Release verification used swift build -c release --product adevcontainer; the pre-existing bare release build test-target issue is out of scope.

No release/tag publication, merge, tap update, credential changes, or service installation is requested by this PR.