feat(dashboard): add guarded Visual Hive setup bridge

[DavidDiaz0317]

Summary

• add owner-only dashboard control-plane endpoints for Visual Hive setup planning and apply
• derive repository identity from the running Hive configuration instead of accepting a caller-selected repository
• use the dashboard's saved GitHub device-flow owner authorization only inside the setup subprocess; never expose it to agent terminals, API responses, logs, or persisted setup config
• bind apply to the exact SHA-256 of a freshly recomputed plan and fail closed on drift
• keep the existing hive setup implementation, managed setup PR, persistent state selection, audit trail, and ordinary Hive/dashboard runtime ownership

Root cause

Hosted Hive correctly strips GitHub and GitHub App credentials from every agent terminal. The integrated setup CLI and stdio MCP server therefore cannot apply setup inside the hosted instance, even though the dashboard already has a separately authenticated owner and persistent state volume. There was no trusted control-plane bridge from that owner session to the existing setup implementation.

This was reproduced on DavidDiaz0317/visual-hive-demo-site after the read-only setup plan passed on Hive 4c6baa3: the supervisor terminal had neither gh nor readable /data/gh-user-token, by design. Copying a token into the terminal would weaken the security boundary, so this PR adds the missing owner-only bridge instead.

Security properties

• POST only and subject to existing dashboard authentication/role enforcement
• owner role required
• active dashboard actor must match the saved GitHub device-flow identity
• primary repository is bound server-side
• strict request schema; unknown fields and non-immutable Visual Hive refs are rejected
• apply requires the exact current plan digest
• child environment replaces only HIVE_GITHUB_TOKEN; the parent environment is unchanged
• failures are scrubbed and audit records contain only repository, Visual Hive ref, and an error digest
• no second scheduler is started; ordinary Hive/dashboard remains the runtime owner

Validation

• go build ./...
• go vet ./...
• Windows focused: go test ./pkg/dashboard ./cmd/hive -run 'TestIntegratedSetup|TestDashboardIntegratedSetup|TestDashboardSetupEnvironment' -count=1 -timeout 5m
• Linux affected packages: go test ./pkg/dashboard ./cmd/hive -count=1 -timeout 12m
• Linux race: go test -race ./pkg/dashboard ./cmd/hive -run 'TestIntegratedSetup|TestDashboardIntegratedSetup|TestDashboardSetupEnvironment' -count=1 -timeout 8m
• git diff --check

The broad Linux test attempt reached all affected packages green. Its remaining failures were unrelated existing/environment-owned checks: the inherited agent-state flake, credential-guard git ownership in a Windows bind mount, and generated-script tests in a bare Go image without Node. The broad Windows dashboard package also reproduced its existing Unix-mode assertion (0666 versus 0600).

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment