[Fix] Large repository clones no longer restart after timeout

[roomote-roomote]

Opened on behalf of Matt Rubens. View the task or mention @roomote for follow-up asks.

What changed

• Added a validated WORKER_REPOSITORY_CLONE_TIMEOUT_SECONDS deployment setting with a 600-second default and forwarded it to workers as internal-only configuration.
• Kept full repository clones while separating deterministic timeout failures from transient failures. Timeouts now fail after one attempt with an actionable operator hint; transient failures retain cleanup and retry with exponential backoff.
• Added timeout classification plus bounded, credential-sanitized command diagnostics, focused regression coverage, and self-hosting documentation.

Why this change was made

Large repositories could exceed the fixed five-minute clone deadline and restart the entire transfer five times. Operators had no supported way to raise that deadline, and the resulting diagnostics did not clearly identify the timeout.

Impact

Repository clones now have ten minutes by default, self-hosted operators can increase the deadline for large repositories or slower networks, and deterministic timeouts no longer repeatedly discard and restart the same transfer. Existing full-history clone behavior remains unchanged.

Linked work items

Closes #932

[roomote-roomote]

No code issues found. See task

_{Reviewed eb4f65d}