feat: configure sparse repository checkout per intent

[ivancasco]

Draft status: Fable 5.1 found two staging bugs in the current PR head. Fixes and regression tests pass locally, but the follow-up commit is not yet pushed because the configured 1Password signer failed. Keep this draft until that commit lands.

Large working trees can exhaust AgentCore's managed session storage before an intent starts. Add optional per-repository directory selection to the New Intent form and creation API. For example, sparseCheckout: { "owner/monorepo": ["services/api", "packages/shared"] } checks out those directories using Git cone mode. Omitted or empty selections retain full checkout.

The runtime clones with --no-checkout, configures the cone before materializing files, and carries the immutable selection through stage restoration and parallel lane operations. Input validation rejects unknown repositories and unsafe paths. Tests cover real Git checkout, selected-file commits without deleting excluded files, warm reuse, mount-loss recovery, API validation, and UI submission.

This mitigates #438; it does not fully resolve it. Git history is still downloaded in full, cone mode includes root/ancestor files, and the selected tree plus metadata and agent state must still fit in managed storage. Partial clone, larger storage, and broader storage-error reporting remain separate work.

Validation of the local follow-up (not yet pushed because 1Password commit signing failed):

• Full backend suite: 157 files / 2,851 tests passed on both Node 22.22.3 and Node 24.18.0 sequentially with separate temporary GIT_CONFIG_GLOBAL files, --maxWorkers=4, and GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false (test-process-only override; temporary fixture commits otherwise wait on the local 1Password signer).
• Full frontend suite: 77 files / 541 tests passed with --maxWorkers=4. The initial unrestricted run timed out in ToolsRegistry; that file also passes in isolation.
• Root and frontend lint and formatting checks passed (existing lint warnings remain).
• Full secretlint and AWS SDK alignment checks passed; SDK check emits existing non-AWS range warnings.
• Frontend TypeScript and production Vite build passed (existing chunk-size warning).
• Pre-commit production audit reports existing root dependency findings (2 high, 2 moderate); no dependency manifests or lockfiles changed. Frontend production audit is clean.
• Upstream fork workflows currently report action_required; CI/CodeQL is not claimed as passed. Optional local semgrep/opengrep scanners are not installed. No Terraform files changed.

Independent review: Claude Fable 5.1 reviewed the complete diff and surrounding code. Two staging bugs were reproduced with real Git: committing new files outside the sparse cone, and concluding an out-of-cone merge conflict. Both are fixed locally with git add -A --sparse and regression tests; the fix commit is pending successful signing. Leading/trailing whitespace in API directory selections is now rejected. Fable 5.1's focused follow-up confirmed the fixes and found no new concrete bug. Generic initialization-error wording and showing the immutable selection on the intent detail page remain follow-up improvements.