feat(plugins): add source-control extension contracts (#2117)

apps/backend/internal/agent/runtime/lifecycle/remote_github_env.go

@@ -6,7 +6,10 @@ import (
 	"github.com/kandev/kandev/internal/githubauth"
 )
 
-var managedGitHubBrokerEnvKeys = []string{
+// managedGitCredentialBrokerEnvKeys retain the existing agentctl environment
+// contract while carrying provider-neutral opaque leases and helper scopes.
+// None of these values is a Git access token.
+var managedGitCredentialBrokerEnvKeys = []string{
 	githubauth.CredentialBrokerURLEnv,
 	githubauth.CredentialLeaseEnv,
 	githubauth.CredentialTaskIDEnv,
@@ -19,15 +22,15 @@ var managedGitHubBrokerEnvKeys = []string{
 	"GIT_TERMINAL_PROMPT",
 }
 
-// managedGitHubBrokerEnv returns only the runtime values needed by the
+// managedGitCredentialBrokerEnv returns only runtime values needed by the
 // broker-backed git helper and gh shim. It deliberately excludes unrelated
 // profile and control-plane secrets from the long-lived agentctl process.
-func managedGitHubBrokerEnv(env map[string]string) map[string]string {
+func managedGitCredentialBrokerEnv(env map[string]string) map[string]string {
 	if env[githubauth.CredentialBrokerURLEnv] == "" {
 		return nil
 	}
-	result := make(map[string]string, len(managedGitHubBrokerEnvKeys)+1)
-	for _, key := range managedGitHubBrokerEnvKeys {
+	result := make(map[string]string, len(managedGitCredentialBrokerEnvKeys)+1)
+	for _, key := range managedGitCredentialBrokerEnvKeys {
 		if value := env[key]; value != "" {
 			result[key] = value
 		}
@@ -52,6 +55,16 @@ func copyIndexedGitConfig(source, target map[string]string) {
 	}
 }
 
-func hasManagedGitHubBrokerEnv(env map[string]string) bool {
+func hasManagedGitCredentialBrokerEnv(env map[string]string) bool {
 	return env[githubauth.CredentialBrokerURLEnv] != "" && env[githubauth.CredentialLeaseEnv] != ""
 }
+
+// Deprecated compatibility wrappers keep existing lifecycle call sites and
+// agentctl contract tests stable while their behavior is provider-neutral.
+func managedGitHubBrokerEnv(env map[string]string) map[string]string {
+	return managedGitCredentialBrokerEnv(env)
+}
+
+func hasManagedGitHubBrokerEnv(env map[string]string) bool {
+	return hasManagedGitCredentialBrokerEnv(env)
+}