feat: add repo-config Durable Object + push sync workflow

[xmtp-coder-agent]

Resolves #112

Summary

On every push to a repo's default branch, the Worker now fetches .code-factory/config.toml from the head SHA, sparse-validates it (TOML + Zod), and overwrites a per-repo SQLite-backed Durable Object. Defaults are applied only on read, so the stored record stays sparse and defaults can evolve without migrations.

New surfaces

• ConfigPushEvent — fifth variant of the Event union (src/events/types.ts).
• RepoConfigWorkflow — dedicated WorkflowEntrypoint that runs runSyncRepoConfig (src/workflows/repo-config-workflow.ts).
• runSyncRepoConfig — three-step factory: fetch-config-file → parse-and-validate → store-repo-config (src/workflows/steps/sync-repo-config.ts).
• RepoConfigDO — SQLite-backed Durable Object using synchronous ctx.storage.kv (src/durable-objects/repo-config-do.ts).
• GitHubClient.getRepoContentFile — 404/directory/symlink/non-base64 all resolve to null (src/services/github/client.ts).
• Sparse + resolved Zod schemas for [sandbox], [harness], [[scheduled_jobs]] (src/config/repo-config-schema.ts).

Wiring

• wrangler.toml — new [[workflows]], [[durable_objects.bindings]], and [[migrations]] (v1, new_sqlite_classes = ["RepoConfigDO"]).
• src/main.ts — branches workflow dispatch on result.type === "config_push".
• TaskRunnerWorkflow — config_push guard throws NonRetryableError (misrouting is observable, not silent).
• buildInstanceId — deterministic composite config_push-{repoName}-{headSha}-{deliveryId} preserves the dedupe anchor.

Testing

• Unit tests for schemas, DO round-trip, router, step factory, instance-id, and GitHub client.
• Integration tests for push dispatch (202 happy path, 200 non-default-branch skip, 200 duplicate delivery, 401 unsigned).
• End-to-end test using introspectWorkflow over the real REPO_CONFIG_WORKFLOW binding.
• Full suite: 350 tests, all green.

Test plan

• npm run typecheck — clean
• npm run lint — clean
• npm run format:check — clean
• npm test — 350 passed
• npx wrangler types is idempotent against the committed worker-configuration.d.ts
• All 26 EARS requirements from the spec have implementation + test coverage (verified by spec-reviewer)

Spec & plan

• Design: docs/plans/2026-04-20-issue-112-design.md
• Tasks: docs/plans/2026-04-20-issue-112-tasks.md

Follow-ups (not in this PR)

• GitHub App manifest must grant contents:read for getRepoContentFile to see .code-factory/config.toml.
• scheduled_jobs[].schedule cron validation is a string today; future work could add a cron-pattern check.
• Downstream consumers (TaskRunner, sandbox provisioning) will read RepoConfigDO.getRepoConfig() in separate issues per §2 non-goals.

🤖 Generated with Claude Code

Note

Add RepoConfigDO Durable Object and RepoConfigWorkflow to sync repo config on push

• Adds a config_push event type and routes default-branch GitHub push webhooks to a new RepoConfigWorkflow instead of TaskRunnerWorkflow.
• RepoConfigWorkflow runs three steps: fetch .code-factory/config.toml at the pushed SHA via GitHubClient.getRepoContentFile, parse/validate it with parseRepoConfigToml (using smol-toml and Zod), then write sparse settings to RepoConfigDO.
• RepoConfigDO is a new SQLite-backed Durable Object keyed by repository full name; it stores identity fields and sparse config separately, applying Zod defaults only at read time via resolveRepoConfigSettings.
• Push events to non-default branches are skipped; TaskRunnerWorkflow now throws NonRetryableError if it receives a config_push payload.
• Risk: new RepoConfigDO SQLite migration (v1) and REPO_CONFIG_WORKFLOW binding are provisioned on next deploy.

^{Macroscope summarized cc532f3.}