fix(setup): retry-with-backoff git clones, force HTTPS for setup deps (#84)

Two failure modes hit during a fresh end-to-end install:

1. `gh repo clone` constructs the underlying `git clone` URL based on the
   user's gh `Git operations protocol` setting. Users with `ssh` set
   (often by older interactive logins) and no SSH key registered hit a
   cryptic `Permission denied (publickey)` on every plugin clone.

2. GitHub HTTP/2 returns transient 500s during setup runs ("error: RPC
   failed; HTTP 500"). A single attempt with no retry leaves the user
   to delete partial clones and re-run. The same URL succeeds seconds
   later, and HTTP/1.1 dodges the issue entirely.

Add `git_clone_with_retry` (lib/common.sh) that:
- Pins `http.version=HTTP/1.1` on the per-invocation git config.
- Sets `url.https://github.com/.insteadOf=git@github.com:` so SSH-style
  URLs (whether explicit or constructed by gh) get rewritten transparently.
- Retries with exponential backoff (3 attempts: 2s, 4s, 8s), cleaning up
  the partial directory between attempts.
- Forwards extra args (used for `--depth 1` from the skills installer).

Wire it into:
- `install_plugin` (lib/wordpress.sh) — drops the gh-vs-git branching;
  plain `git_clone_with_retry` covers public github.com, GitHub
  Enterprise, and any HTTPS git host. (gh remains used elsewhere for
  issue/PR work where its auth helper actually matters.)
- `install_skills_from_repo` (lib/skills.sh) — same path, same
  resilience for the WordPress + Data Machine skills bundles cloned
  during Phase 8.5.

Closes #83

Author: lezama

lib/common.sh

@@ -29,3 +29,44 @@ write_file() {
     echo "$content" > "$file_path"
   fi
 }
+
+# Robust git clone for setup-time plugin/skill deps:
+#   - Pins HTTP/1.1 to dodge intermittent GitHub HTTP/2 500s seen during
+#     fresh setup runs.
+#   - Rewrites SSH-style URLs (git@github.com:…) to HTTPS so users with
+#     `gh auth status` reporting `Git operations protocol: ssh` but no SSH
+#     key registered don't hit cryptic `Permission denied (publickey)`.
+#   - Retries with exponential backoff (default 3 attempts: 2s, 4s, 8s)
+#     and cleans up partial directories between attempts.
+#
+# Usage: git_clone_with_retry <url> <dir> [extra git-clone args…]
+git_clone_with_retry() {
+  local url="$1"
+  local dir="$2"
+  shift 2 || true
+  local max_attempts=3
+  local delay=2
+  local attempt
+
+  if [ "$DRY_RUN" = true ]; then
+    echo -e "${BLUE}[dry-run]${NC} git clone $url $dir $* (with HTTPS rewrite + HTTP/1.1 + retry)"
+    return 0
+  fi
+
+  for attempt in $(seq 1 "$max_attempts"); do
+    if git \
+        -c http.version=HTTP/1.1 \
+        -c "url.https://github.com/.insteadOf=git@github.com:" \
+        clone "$@" "$url" "$dir"; then
+      return 0
+    fi
+    if [ "$attempt" -lt "$max_attempts" ]; then
+      warn "Clone of $url failed (attempt $attempt/$max_attempts); retrying in ${delay}s..."
+      rm -rf "$dir"
+      sleep "$delay"
+      delay=$((delay * 2))
+    fi
+  done
+  warn "Clone of $url failed after $max_attempts attempts."
+  return 1
+}

lib/skills.sh

@@ -14,7 +14,8 @@ install_skills_from_repo() {
 
   local tmp_dir
   tmp_dir=$(mktemp -d)
-  if git clone --depth 1 "$repo_url" "$tmp_dir" 2>/dev/null; then
+  rmdir "$tmp_dir" 2>/dev/null || true  # git_clone_with_retry needs a non-existent target on retry.
+  if git_clone_with_retry "$repo_url" "$tmp_dir" --depth 1; then
     for skill_dir in "$tmp_dir"/*/; do
       local skill_name
       skill_name=$(basename "$skill_dir")

lib/wordpress.sh

@@ -31,16 +31,8 @@ install_plugin() {
   local plugin_dir="$SITE_PATH/wp-content/plugins/$slug"
 
   if [ ! -d "$plugin_dir" ] || [ "$DRY_RUN" = true ]; then
-    # Prefer gh CLI for GitHub repos (avoids proxy/auth issues).
-    # Strip .git suffix first, then extract owner/repo — macOS sed doesn't
-    # handle the optional \(\.git\)\{0,1\} correctly (greedy [^/]* eats it).
-    local gh_nwo
-    gh_nwo=$(echo "$repo_url" | sed 's|\.git$||' | sed -n 's|^https://github\.com/\([^/]*/[^/]*\)$|\1|p')
-    if [ -n "$gh_nwo" ] && command -v gh &>/dev/null; then
-      run_cmd gh repo clone "$gh_nwo" "$plugin_dir"
-    else
-      run_cmd git clone "$repo_url" "$plugin_dir"
-    fi
+    git_clone_with_retry "$repo_url" "$plugin_dir" || \
+      warn "Clone failed for $slug — install will continue without it"
   elif [ -d "$plugin_dir/.git" ]; then
     log "Plugin $slug already exists — pulling latest..."
     run_cmd git -C "$plugin_dir" pull --ff-only 2>/dev/null || \