symbiont: use system git for private fork fetch on Railway

Railway servers have access to all private AdaWorldAPI repositories by design,
so no token wiring is needed. Set CARGO_NET_GIT_FETCH_WITH_CLI=true so cargo
fetches the git-dep forks through the system git (which honors Railway's
ambient credentials) rather than its built-in libgit2 transport. Drops the
obsolete token-injection note.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CcpLeEC3XK8Eye53GKBVvi

Author: claude

crates/symbiont/Dockerfile

@@ -13,15 +13,19 @@
 # On Railway: set the service's Dockerfile path to `crates/symbiont/Dockerfile`
 # and the root directory to the repo root.
 #
-# AUTH: the AdaWorldAPI forks must be reachable during the build. If they are
-# private, provide a token — e.g. mount a git credential or pass a build secret
-# and configure `git config --global url."https://x-access-token:$TOKEN@github.com/".insteadOf "https://github.com/"`.
+# AUTH: a Railway server has access to all private AdaWorldAPI repositories by
+# design, so no token wiring is needed. The build only has to make cargo use
+# the SYSTEM git (which honors Railway's ambient credentials) rather than its
+# built-in libgit2 transport — done via CARGO_NET_GIT_FETCH_WITH_CLI=true below.
 
 ARG ADA_BRANCH=claude/jirak-math-theorems-harvest-rfii13
 
 # ── builder ──────────────────────────────────────────────────────────────────
 FROM rust:1.95-bookworm AS builder
 ARG ADA_BRANCH
+# Make cargo fetch git deps via the system `git` CLI so it uses Railway's
+# ambient credentials for the private AdaWorldAPI forks.
+ENV CARGO_NET_GIT_FETCH_WITH_CLI=true
 # Native build deps for the closure: aws-lc-sys (C++), zstd/lz4 (C), protoc.
 RUN apt-get update && apt-get install -y --no-install-recommends \
         cmake clang protobuf-compiler pkg-config libssl-dev git ca-certificates \

crates/symbiont/README.md

@@ -40,10 +40,11 @@ docker run --rm symbiont
 2. Set the Dockerfile path to `crates/symbiont/Dockerfile`.
 3. The build proves the stack links; a green build is the deliverable.
 
-**Auth:** the build fetches the AdaWorldAPI forks. If they're private, provide
-a token to the build (e.g. `git config --global
-url."https://x-access-token:$TOKEN@github.com/".insteadOf
-"https://github.com/"` via a Railway build secret).
+**Auth:** a Railway server has access to all private AdaWorldAPI repositories
+by design — no token wiring needed. The Dockerfile sets
+`CARGO_NET_GIT_FETCH_WITH_CLI=true` so cargo fetches the git-dep forks through
+the system `git` (which honors Railway's ambient credentials) instead of its
+built-in transport.
 
 ## Notes