fix(job): surface redacted git stderr from host-side clone

_host_clone hid all stderr ("exit 128" with no cause). Surface the
last stderr lines with scheme://user:pass@ credentials masked, so
failures (e.g. unresolved SSH alias under LocalSystem) are diagnosable.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/ci_orchestrator/commands/job.py

@@ -195,6 +195,11 @@ def _make_clone_name(job_id: str) -> str:
     return f"Clone_{job_id}_{timestamp}_{suffix}"
 
 
+def _redact_url_creds(text: str) -> str:
+    """Mask ``scheme://user:pass@host`` credentials in arbitrary text."""
+    return re.sub(r"(\w+://)[^/\s:@]+:[^/\s@]+@", r"\1***@", text)
+
+
 def _host_clone(
     repo_url: str, branch: str, commit: str, submodules: bool
 ) -> tuple[Path, Path]:
@@ -202,8 +207,8 @@ def _host_clone(
 
     Returns ``(tmp_root, src_dir)``. ``src_dir`` is passed as
     ``host_source_dir`` to the build (zipped and transferred to the
-    guest). The caller must remove ``tmp_root`` when done. The repo URL
-    may embed credentials, so git output is never echoed.
+    guest). The caller must remove ``tmp_root`` when done. git stderr is
+    surfaced with embedded URL credentials redacted.
     """
     tmp_root = Path(tempfile.mkdtemp(prefix="ci-host-clone-"))
     src_dir = tmp_root / "src"
@@ -225,9 +230,10 @@ def _host_clone(
             )
     except subprocess.CalledProcessError as exc:
         shutil.rmtree(tmp_root, ignore_errors=True)
-        # Do not surface stderr verbatim — it can contain the authed URL.
+        detail = _redact_url_creds((exc.stderr or "").strip())
+        tail = " | ".join(detail.splitlines()[-3:]) if detail else "(no stderr)"
         raise click.ClickException(
-            f"host-side git clone failed (exit {exc.returncode})"
+            f"host-side git clone failed (exit {exc.returncode}): {tail}"
         ) from None
     return tmp_root, src_dir