Git integration: push the generated app to the user's own GitHub (per-user / multiple accounts)

[tastyeffectco]

Motivation

A common ask for an app-builder backend: after the agent builds an app, push it to the user's own git repo so they can keep iterating / deploy it. Genuinely useful and roadmap-worthy.

Why a fresh design (not a revival)

sandboxd previously had a git_remote_url + auto-push-on-task-finish path, but it was removed (#23) because it:

• used a single host-side master token → could only ever push as one identity (no per-user / multiple accounts),
• was undocumented and dormant by default (no token wiring in install.sh / compose / .env.example),
• and put the token in the git argv (visible in /proc/<pid>/cmdline).

So this needs a proper design, not the old code back.

To figure out

• Per-user credentials — GitHub App / OAuth, or per-sandbox/per-project tokens stored securely. Must support multiple accounts, not one shared token.
• Trigger — on task finish, or an explicit POST /v1/sandboxes/{id}/push?
• Token handling — never in argv (GIT_ASKPASS / credential helper), never in .git/config, never inside the sandbox.
• Repo-create vs push-to-existing, branch strategy, token refresh.
• Multi-provider later (GitHub first; GitLab/Gitea?).

Non-goals (first cut)

• Continuous sync / file-watching (export-zip already covers handoff).
• Re-introducing the single-master-token model.

Feedback + use-cases welcome 👍 — especially on the per-user auth model (GitHub App vs PAT vs OAuth).