Address PR review comments: fix ref counting, dedup resolveAuth, remove unused CacheStatus

- Fix Release() ref counting bug: avoid calling getRef() which increments
  count, instead look up ref directly and clean up when count reaches zero
- Remove unpopulated CacheStatus struct and fields from types, deepcopy,
  and CRD manifest since nothing writes to them
- Extract duplicated resolveAuth into shared pkg/gitauth package with
  explicit key validation for missing "username"/"password" keys
- Fix GC() race condition by skipping paths with active in-process refs
- Remove misleading WorkspaceCacheMiss metric increment for in-memory
  (non-cache) code paths
- Change push controller from shallow to full clones to avoid silent
  failures when transactions reference historical commits
- Add tests for ref count cleanup, ref leak prevention, GC active ref
  skipping, and gitauth key validation

https://claude.ai/code/session_01WJE6ozYXZMn1CD6d4vy8b6

cmd/push-controller/main.go

@@ -17,9 +17,10 @@ func main() {
 	go health.ServeMetrics(ctx, ":9090") //nolint:errcheck
 
 	// GIT_CACHE_DIR enables PVC-backed workspace caching when set.
-	// Push controller uses shallow clones since it only needs to push refs.
+	// Push controller needs full history to resolve refs referenced by
+	// push transactions (e.g., older tags or historical commits).
 	cacheDir := os.Getenv("GIT_CACHE_DIR")
-	wsMgr := workspace.NewManager(cacheDir, true /* shallow */)
+	wsMgr := workspace.NewManager(cacheDir, false)
 	ctx = workspace.WithManager(ctx, wsMgr)
 
 	sharedmain.MainWithContext(ctx, "push-controller", push.NewController)