fix(checkout): use git clone instead of gh repo clone

Root cause: gh repo clone creates incomplete clones where commit objects
are missing from the pack file. The refs and .idx files exist, but the
actual .pack data is not fully downloaded. This causes "bad object HEAD"
and "corrupt patch at line N" errors.

Fix: use git clone --depth 1 with HTTPS URL directly. This is more reliable
and also avoids the gh-specific syntax issues.

Changed:
- First clone: 'git clone --depth 1 --branch {branch} --
  https://github.com/{repo}.git {path}'
- Retry clone: same (already used --depth 1)
- Removed both gh repo clone invocations

Note: git clone sets up origin remote (unlike gh repo clone), which also
enables 'git fetch origin' in the cache sync path.

Verification:
- php -l: no errors
- PHPStan level 8: 0 errors
- Worker tests: 75/75 pass
- CLI tests: 232/232 pass

Author: detain

scripts/github-code-review.php

@@ -1472,14 +1472,15 @@ function checkoutBranch(string $repo, string $branch, string $checkoutPath): str
         cleanupCheckout($checkoutPath);
     }
 
-    // Use gh repo clone which automatically uses gh authentication
-    // Correct syntax: gh repo clone <repository> [<directory>] [-- <gitflags>...]
-    // Directory must come BEFORE '--', branch must come AFTER '--'
+    // Use git clone directly (not gh repo clone) — gh repo clone creates
+    // incomplete clones where commit objects are missing from the pack file,
+    // causing "bad object HEAD" and "corrupt patch" errors during apply.
+    // We pass --depth 1 for faster clones since we only need the base branch.
     $cloneCmd = sprintf(
-        'gh repo clone %s %s -- --branch %s 2>&1',
-        escapeshellarg($repo),
-        escapeshellarg($checkoutPath),
-        escapeshellarg($branch)
+        'git clone --depth 1 --branch %s -- %s %s 2>&1',
+        escapeshellarg($branch),
+        escapeshellarg("https://github.com/{$repo}.git"),
+        escapeshellarg($checkoutPath)
     );
 
     verbose_log("executing: {$cloneCmd}", 3);
@@ -1521,12 +1522,12 @@ function checkoutBranch(string $repo, string $branch, string $checkoutPath): str
             return 'shutdown';
         }
 
-        // Try with --depth 1 passed through to git (after --)
+        // Try git clone --depth 1 (full clone may have network issues)
         $cloneCmd = sprintf(
-            'gh repo clone %s %s -- --depth 1 --branch %s 2>&1',
-            escapeshellarg($repo),
-            escapeshellarg($checkoutPath),
-            escapeshellarg($branch)
+            'git clone --depth 1 --branch %s -- %s %s 2>&1',
+            escapeshellarg($branch),
+            escapeshellarg("https://github.com/{$repo}.git"),
+            escapeshellarg($checkoutPath)
         );
         exec($cloneCmd, $cloneOutput, $cloneRet);