[AK-618] akua: private-HTTPS auth in git_fetcher → enable install upstream vendoring

[robinbraemer]

Migrated from Linear: AK-618

GitHub is the canonical source of truth. The Linear issue is archived.

---

Why

CEP-0018 ships install-as-Package, but every install render currently fails with E_CHART_RESOLVE because the install repo's ./upstream/ directory is empty. We deliberately deferred a vendoring workaround in cnap because the right fix is one missing feature in akua: the git_fetcher only handles public HTTPS, so we can't declare a git = "<akua-git-url>" dep against the private composed-Package repo. Pre-alpha, no users blocked — but every render path in CEP-0018 stays on a sand foundation until this lands.

Description

Land private-HTTPS auth in akua's git_fetcher, then flip the install Package's upstream dep from path to git so akua resolves it natively at render time.

Approach (akua, in repo ~/Developer/cnap-tech/akua):

• Wire the existing oci_auth credential store into the gix HTTPS transport in crates/akua-core/src/git_fetcher.rs. The doc comment at lines 27-29 already names this as the unfinished slice — oci_auth is reusable, the work is plumbing it into gix's transport callbacks.
• Cover with a unit test using a token-mounted credential helper against a file:// mirror, plus an in-process auth scenario if gix's test harness allows.
• Document in docs/cli.md (auth section) and add an AKUA_GIT_TOKEN_FILE env var if one doesn't already exist alongside AKUA_TOKEN_FILE.

Approach (cnap, this repo):

• apps/web/src/lib/api/server/installs/installs.package-generator.ts:67-74 — flip upstream = { path = "./upstream" } to upstream = { git = "<akua-git-url>/<composed-pkg-repo>.git", tag = "<composed-pkg-version>" }. Inputs need to thread the composed Package's repo URL + version through to generateAkuaToml (currently scoped to install metadata only).
• installs.workflows.bootstrap.ts:95 — drop 'upstream' from ensureWorkspaceDirs. Resolver now materializes via cache; no working-tree dir needed.
• Confirm the install bootstrap PAT is scoped to read the composed Package's repo (or mint a separate read-scoped token at bootstrap and surface it to akua via the configured token file).
• Drop the deferred-state comment in installs.package-generator.ts and the gap note in installs.workflows.render.integration.test.ts:85-88. Add a real end-to-end render test that exercises the new git resolution path.

Acceptance Criteria

• akua render resolves a git = "<private-https-url>", tag = "..." dep using a PAT, against a token-protected git server (a testcontainer or file:// mirror with auth proxy is fine).
• Token comes from a configurable source — env var, token file, or akua-cli credential helper — and never appears in akua telemetry, logs, or lockfile.
• cnap install Package generator emits git = "..." instead of path = "./upstream" and bootstrap stops creating the empty ./upstream/ directory.
• An install whose upstream is a composed Package renders end-to-end through the production bootstrap → render path with no extra cnap-side vendoring step.
• CEP-0018 doc's "Deferred (2026-05-07)" entry is replaced with a "Resolved" entry referencing the merged akua + cnap PRs.

Out of Scope

• SSH transport for git deps (akua already calls this out as a separate slice).
• A replace = { ... } override flow for swapping a git dep for a local fork during dev — orthogonal, can come later.
• Standing up a real OCI registry to flip git → oci long-term — separate follow-up once real customers are on production akua-git.
• Tarball-in-repo + akua pack-and-extract bridge — explicitly rejected in the CEP-0018 deferred entry to avoid unwind debt.

Refs

• akua: crates/akua-core/src/git_fetcher.rs:27-29 — the deferred-work doc comment
• akua: crates/akua-core/src/oci_auth.rs — credential store to reuse
• cnap: internal/cep/20260429-packages-and-proposals.md — Implementation History deferred entry (2026-05-07)
• cnap: apps/web/src/lib/api/server/installs/installs.package-generator.ts:67-74
• cnap: apps/web/src/lib/api/server/installs/installs.workflows.bootstrap.ts:95
• cnap: apps/web/src/lib/api/server/installs/installs.workflows.render.integration.test.ts:85-88