fix(review): stop contacting the git remote from the idle freshness poll; add PLANNOTATOR_GIT_REMOTE_CHECK opt-out and kill orphaned git transports on exit

[backnotprop]

Problem

Closes #1553.

During a code review session that is open but idle — page up, nobody
touching it — the server ran git ls-remote --symref origin HEAD about once a
minute, indefinitely. Closing the page stopped it. Where SSH authentication is
backed by a hardware token, each probe is a physical touch prompt, so the
reporter's YubiKey kept blinking beside an agent that correctly reported itself
as idle; nothing in the UI showed an operation in flight.

Two independent causes, both fixed here:

1. The client polls GET /api/diff/fresh every 5s to keep the "Diff out of
   date" banner honest. That handler called maybeRefreshRemoteBaseInfo(),
   whose 60s rate limit was the only thing standing between a 5s poll and a
   network round trip — so an idle page produced one remote query per minute
   forever, and a remote that could never answer was retried on that same
   cadence for the life of the session.
2. Git commands run with interaction: "forbid" are spawned detached in their
   own process group so a timeout can kill the whole git/ssh tree. That
   parent-side timer is the only thing that ever reaps them, and it dies with
   the parent — so a server stopped mid-probe orphaned the git/ssh pair.

Reproduction (before)

A repo whose origin is an unreachable SSH URL (git@192.0.2.1:x/y.git), with
GIT_SSH_COMMAND pointing at a script that logs each invocation with a
timestamp and then hangs. plannotator review from source,
PLANNOTATOR_BROWSER=/usr/bin/true, then /api/diff/fresh polled every 5s for
four minutes with no other interaction:

06:38:06  startup — detectRemoteDefaultCompareTarget → ls-remote
06:38:06  startup — /api/diff → maybeRefreshRemoteBaseInfo
06:38:11  startup — refreshRemoteBaseInfo after the compare-target promise
06:39:13  ← idle freshness poll
06:40:14  ← idle freshness poll
06:41:15  ← idle freshness poll

Six invocations in 4m08s, three of them purely from the idle poll, continuing
for as long as the page stays open. A separate run with no polling at all
isolates the startup window at three, and a stack-trace run identifies each
call site — including that detectRemoteDefaultCompareTarget itself runs an
ls-remote, which is why an opt-out has to skip the whole startup block.

Orphan check, with SIGTERM delivered while a probe is still hanging (the
fake ssh sleeps far past the server's own 5s transport timeout, so only an
exit-time reap could explain a dead child): the transport survives the server.

Change, per runtime

Both runtimes change together, as the "Server Runtimes" section requires: the
Bun server in packages/server/ and the node:http mirror in
apps/pi-extension/server/.

Where the remote probe lives. Removed from /api/diff/fresh; added to
/api/diff/switch, which backs the diff-type and base pickers and the "Diff
out of date · Refresh" button — the interactions where a reviewer is actually
asking for a fresh answer. Startup, the /api/diff page load and the explicit
/api/fetch-base are unchanged. The switch call is fire-and-forget, so a
hanging remote can never make a diff switch wait on the network: that response
carries the cached staleness and the next one carries the refreshed value.
baseBehindRemote still rides every /api/diff/fresh response from the
cached value, so the banner neither flickers nor drops out between refreshes.

Negative caching. A failed probe doubles the interval up to a 15-minute
cap; a success resets it to 60s. The policy is one shared helper
(nextRemoteBaseCheckInterval in packages/shared/review-core.ts) so the two
runtimes cannot drift.

Opt-out. plannotator review --no-git-remote-check, PLANNOTATOR_GIT_REMOTE_CHECK=0
(also false / disabled), or { "gitRemoteCheck": false } in
~/.plannotator/config.json; precedence flag > env > config, resolved by
resolveRemoteCheck in packages/shared/config.ts beside its sibling
resolvers. With it off the session issues zero ls-remote calls, startup
probes included — the startup block is skipped whole, because the compare-target
detection is itself an ls-remote and an opt-out that only silenced the
staleness probe would still prompt for authentication as the review opens. The
base stays whatever local ref discovery resolved, the banner never shows, and
POST /api/fetch-base stays reachable on its own predicate, because an explicit
Fetch is the user asking for the network.

The flag is parsed by the shared parseReviewArgs, so it works on every
host that forwards review arguments — Claude Code, OpenCode and Pi — not only
the Bun CLI. The reporter is on OpenCode, so a Bun-only flag would have missed
them.

Orphaned transports. Both runtimes track the process-group leaders of
in-flight isolated commands and SIGKILL each group from a synchronous
process.on("exit") hook, installed lazily on the first such spawn. "exit" is
the right hook: it runs on every process.exit(), which is where the CLI's
SIGINT/SIGTERM handling already routes. POSIX only, reusing the existing win32
carve-out.

Behavior kept

HTTPS and passwordless-SSH users lose nothing they would notice. The remote is
still queried at startup, on /api/diff, on every diff-type/base switch and on
Fetch, still rate limited to once a minute, and baseBehindRemote still rides
every diff payload and every freshness response. The banner, the one-click
Fetch, the base picker and the startup upgrade of a bare main to origin/main
all behave as before. Only plain local git sessions were ever affected; PR, jj,
GitButler, P4, workspace and static-patch sessions never ran the check.

Behavior changed

A push that lands on the base branch mid-review is no longer noticed within
the minute on its own. It appears on the next refresh, diff switch or page
reload. That is the deliberate trade: the old within-the-minute detection cost
a network round trip per minute per open tab, whether or not anyone was looking.

Also release-note-worthy: with the opt-out on, the compare target comes from
local refs only, so a repo whose origin/HEAD is unset may resolve a different
default than the remote would have reported.

Tests

All dual-runtime where the code is, and each new guard was confirmed to fail
against the previous behavior before being kept:

• packages/server/review-remote-check.test.ts (new, Bun + Pi, 6 tests). Counts
  ls-remote invocations with a git shim on PATH that logs and then execs the
  real git, against a real local bare remote deliberately left ahead of the
  tracking ref so baseBehindRemote is genuinely true. Guards: an idle session
  issues nothing beyond the startup probes with the clock advanced past the
  interval (at real speed the old rate limit would have hidden the bug —
  verified: both runtimes fail this test against the pre-fix handler);
  baseBehindRemote rides all twelve freshness responses; a switch inside the
  interval stays quiet while a switch past it probes exactly once (fails when
  the new call is removed); the opt-out is network-free end to end (fails when
  the startup block is left ungated).
• packages/server/git-background.test.ts (+1 per runtime): exit kills a
  still-hanging transport, with a command timeout far longer than the child's
  lifetime so only the exit hook can account for the kill. Fails with the hook
  disabled.
• packages/shared/config.test.ts: a 13-row resolveRemoteCheck precedence
  table plus the shared config-coercion table.
• packages/shared/review-core.test.ts: backoff doubling to the cap, reset on
  success, and no overshoot.
• packages/shared/review-args.test.ts and
  apps/pi-extension/review-args-parity.test.ts: the flag parses, composes with
  the other selectors, is absent when not typed (so it cannot outrank the env
  var), and is present in the vendored copy Pi parses through.

Counts, on this branch:

• bun test packages/server packages/shared apps/pi-extension — 2305 pass,
  1 skip, 0 fail, 7569 expect() calls, 152 files.
• bun test (full) — 4994 pass, 1172 skip, 0 fail, 46594 expect() calls,
  534 files.
• tsc --noEmit across all nine project configs — clean.

Reproduction (after)

Same fixture, same four-minute idle poll, rebuilt from this branch:

07:14:43  startup
07:14:43  startup
07:14:47  startup
(nothing for the remaining ~4 minutes of idle polling)

Three invocations, all inside the first five seconds. A diff switch past the
interval triggers exactly one more. SIGTERM during an in-flight probe leaves no
surviving child, where the same run with the exit hook disabled orphans it.