feat: add one-command public GitHub repository analysis

[aryamthecodebreaker]

Summary

• accept canonical public https://github.com/owner/repository inputs in both the CLI and MCP server
• anonymously shallow-clone the default branch into an isolated temporary checkout, scan it without running repository code, record the exact branch + commit, and remove it before returning
• reject credentials, non-HTTPS/non-GitHub URLs, branch/file URLs, remote diff options, private/missing repositories, timeouts, empty repositories, and cleanup failures with clear hard errors
• isolate Git from inherited credentials/config/tokens and Git/SSH askpass helpers; disable hooks, submodules, symlinks, LFS smudging, and interactive authentication
• add deterministic URL, failure, cleanup, concurrency, environment-isolation, local-regression, and MCP tests
• prepare coherent 0.5.0 package/changelog/registry metadata, include MIT licenses in both npm packages, and improve npm discovery metadata + public quick-start copy
• make publishing fail closed: require a stable tag already on main, assert every version, verify npm and the exact MCP Registry entry, then create the public GitHub release last

Why

The first FixMap trial currently requires users to clone a repository, change directories, run the CLI, and clean up afterward. Passing a GitHub URL was instead resolved as a malformed Windows filesystem path. This removes that adoption friction while keeping FixMap's analysis local, deterministic, and non-executing.

Closes #54.

User impact

A real repository can now be tried in one command:

npx -y @aryam/fixmap plan \
  --issue "chat memory returns the wrong value" \
  --repo https://github.com/aryamthecodebreaker/AGI-v1

Remote URL mode is deliberately issue-only in this release. Users still clone locally when they need --diff, --base, or --head; returned paths and commands are informational because the temporary checkout has already been removed.

Verification

• npm run ci — green end to end
  • 84 tests passed (Action 5, CLI/MCP 41, core 38)
  • workspace typecheck and ESLint passed
  • core, CLI, Action bundle, and production Next.js build passed
  • Action bundle drift check passed
  • CLI/Action/workspace smoke checks passed
  • ranking evaluation passed (7/8 top-3 hits, 5/8 top-1)
  • deterministic 1,000-file scanner check passed
• both npm pack --dry-run checks pass; each tarball includes LICENSE, and the CLI includes the new repository-source runtime
• publish workflow parses as YAML; every Bash block passes bash -n; the inline version-coherence check passes against v0.5.0 metadata
• pinned official MCP publisher v1.8.0 asset and the live MCP Registry response shape were verified
• live public URL smoke against aryamthecodebreaker/AGI-v1 ranked src/brain/memoryExtraction.ts first and recorded main@e7da18d122fac8ed380f4ac5379aa8ff7a19a064
• live local-path regression, remote-diff rejection, embedded-credential rejection, missing-repository failure, and inherited-askpass isolation behaved as documented
• temp-directory snapshots before/after successful and failed live clones showed no new fixmap-github-* directory
• git diff --check passed