infra: eliminate working tree — switch data-repo clone to bare

[themightychris]

Why

The pod's working tree is dead weight. gitsheets reads via hologit's tree-object interface; the checked-out files are a redundant on-disk copy of records that already exist as git objects. Costs we eat for nothing:

• ~10 MB working-tree clutter on top of the pack objects (every TOML and .gitsheets/ file checked out alongside the data already encoded in tree blobs).
• git clone does a full checkout at first pod boot, even though nothing reads those files.
• Every reconcile updates the working tree — git fetch is fast, but git checkout/git rebase aren't, and they're working-tree operations on a large repo.
• PVC required to persist the working tree. We've already eaten one Multi-Attach error during a Recreate strategy switch (see runbook). The recovery procedure is currently "delete PVC, restart pod, re-clone."

Going bare:

• Objects-only on disk
• git clone --bare skips checkout
• git fetch updates refs + objects, no IO beyond the pack
• PVC → emptyDir. Re-clone on every pod boot is cheap on a small repo
• Runbook recovery shrinks to "restart pod"

Surface of changes

• deploy/docker/entrypoint.sh — git clone --bare $CFP_DATA_REMOTE $CFP_DATA_REPO_PATH instead of regular clone. The repo path itself becomes the gitdir; no .git subdir.
• apps/api/src/store/public.ts — openRepo({ gitDir: repoPath }) with workTree omitted or equal to gitDir (verify gitsheets behavior; may need an upstream tweak).
• apps/api/src/store/reconcile.ts — the rebase step is the one part of the state machine that wants a working tree. Replace with per-commit replay via git merge-tree --write-tree + git commit-tree, preserving today's linear-history semantics (local commits replayed on top of remote).
• deploy/kustomize/base/deployment.yaml + the PVC manifest — swap the PVC mount for emptyDir. Drop the PVC entirely.
• specs/behaviors/storage.md — document the bare-repo invariant.
• docs/operations/deploy.md — update the boot sequence + env table.
• docs/operations/runbook.md — drop PVC-delete recovery steps.

What stays unchanged

• gitsheets API (reads, transacts, push daemon all bare-friendly)
• git-pod-uploadpack.sh operator helper (bare-native)
• swapPublic pattern after reconcile (gitsheets caches dataTree per Sheet either way)
• HEAD-based merge-base ancestry checks in the hot-reload pre-check

Open questions

• Does gitsheets/openRepo accept a bare gitdir as-is, or does it require workTree to be present (even if unused)? Will verify by reading the gitsheets + hologit sources before writing the plan.
• Local-dev clones — bare is less ergonomic for browsing. Either (a) make bare the only mode and update local-setup docs, or (b) detect/support both. Lean (a) for simplicity, but worth a one-line discussion in the plan.

Plan to land as plans/bare-data-repo.md.