refactor(remote): remove Sprite-exec managed transport

[Ziinc]

Summary

• Managed VMs now go only through managed SSH. The temporary remote-sprite-exec command gateway is gone (PRD non-goal: "A public command gateway that bypasses the authenticated remote transport").
• Provider names no longer appear in repository/workspace APIs or UI copy (PRD: "Provider-specific concepts should not leak into repository/workspace APIs").
• Fixes a hazard: managed_sprite repositories had location.type: "local" and endpoint: null, so dispatchMutation(null, ...) would run a "remote" mutation on the local machine. That path is removed and repository-adapter mutations now require an SSH endpoint by type.

Changes

• Edge Functions: delete remote-sprite-exec (only checked argv[0] === "treq" and passed an arbitrary cwd into bash -lc) and remote-github-clone (no frontend caller; it ran git clone and treq repo inspect through the Sprites exec API) plus _shared/remote/github-clone.ts and its Deno and vitest tests.
• Frontend plumbing: remove execManagedSprite, dispatchOverManagedSprite, remoteBuildCliArgv, the unused dispatchMutation (null endpoint fell back to local), the managed_sprite transport, managedSpriteActiveRepository, the sprite: cache-key prefix, WorkspaceSource/WorkspaceIdentity helpers, the unused terminal type fields added with them, and the unused CloneManagedRepository* types.
• repository-adapter: activeForPath only returns SSH repositories, and transportCreateCommit/transportGitFetch call dispatchMutationOverSsh with repo.transport.endpoint.
• Rust: remove the remote_build_cli_argv Tauri command (only used by the Sprite-exec path) and the unused core::remote_bootstrap module (no app or test callers; the Edge Function copies in boot-manifest.ts/ssh-vm-config.ts are the live versions, comments updated). remote_provider_sprites.rs is kept because src-tauri/tests/remote_e2e.rs uses it.
• UI copy (affects rendered UI): "Treq-managed Sprite" -> "Treq-managed VM", "Create Sprite"/"Retry Sprite creation"/"Delete Sprite" -> "Create VM"/"Retry VM creation"/"Delete VM", plus neutral wording in the setup panel, setup dialog description, and Account settings. The provision idempotency key prefix drops "sprite".
• Provider boundary code (sprites-adapter.ts, stub-sprites-adapter.ts, fly_sprites provider kind, remote-instance internals) is unchanged. Migration 020 is unchanged.

Testing

• npx tsc --noEmit: clean
• npx eslint / npx oxlint on changed files: 0 errors (existing warnings only)
• npx biome format on changed src files: clean
• npx knip: no unused files/exports reported
• npx vitest run --config vitest.unit.config.ts on repository-adapter.test.ts (new), active-repository.test.ts, RemoteSetupDialog.test.tsx, remote-dispatch.test.ts, remote-control-plane.test.ts, AccountSettings.test.tsx: 14/14 passed
• cargo fmt --check, cargo check --locked --all-targets --features tauri-test, cargo clippy --locked --all-targets --all-features -- -D warnings: clean
• Not run: NAPI integration test test/integration/remote-ssh.test.ts (only its button-name matcher changed).

Not in this PR

• Cloning a private GitHub repository onto a managed VM over managed SSH. remote-github-clone minted a GitHub App installation token but used it only inside a Sprites exec call, so there was no cheap piece to keep. A managed-SSH clone flow needs its own token hand-off design.
• User-visible error strings inside remote-instance (e.g. "Sprite bootstrap exited ...") still name the provider; they sit behind the provider boundary and are left for a follow-up to avoid overlapping with other remote-instance work.
  🤖 Generated with Claude Code
  https://claude.ai/code/session_01MbYSPHBRmDYwPJpHG33Y4t
  Generated by Claude Code

[Ziinc]

Inline notes on why each removal was scoped the way it was.

---

Generated by Claude Code

[Ziinc]

activeForPath now narrows to SSH repositories only.

• The old managed_sprite repos had endpoint: null, and dispatchMutation(null, ...) silently ran the mutation locally. Typing the endpoint as required removes that path rather than guarding it.
• Mutations call dispatchMutationOverSsh directly, so the unused null-tolerant dispatchMutation wrapper in remote-dispatch.ts was deleted.

---

Generated by Claude Code

[Ziinc]

Removed rather than trimmed.

• No frontend caller, and every step (clone, treq repo inspect) ran through the Sprites exec API, which is the bypass the PRD rules out.
• The only reusable part is minting an installation token, which is a one-liner over getInstallationToken. Handing that token to a VM over managed SSH needs its own design, noted under "Not in this PR".

---

Generated by Claude Code

[Ziinc]

Deleted because nothing in the app or in src-tauri/tests calls it.

• The live bootstrap and SSH-trust scripts are the Edge Function copies in boot-manifest.ts and ssh-vm-config.ts; their "mirrors remote_bootstrap" comments were updated.
• remote_provider_sprites.rs stays: tests/remote_e2e.rs imports it.

---

Generated by Claude Code

[Ziinc]

These fields were added with the Sprite work and never set anywhere, so the file is back to its pre-#513 shape.

• WorkspaceSource = "local" | "sprite" put a provider name into workspace identity, which the PRD says should not leak.

---

Generated by Claude Code