feat: deploy portable workspace registry

compose.yaml

@@ -17,7 +17,9 @@ services:
       context: .
       dockerfile: docker/core.Dockerfile
     image: thothii-core:local
-    env_file: [deploy/thothii.env]
+    env_file:
+      - path: deploy/thothii.env
+        required: false
     environment:
       HOST: 0.0.0.0
       PORT: "8787"
@@ -26,15 +28,32 @@ services:
       SETTINGS_FILE: /data/settings/settings.json
       THT_CONFIG: /app/harness/workspaces/local.yaml   # configPath di default per i route tht senza workspace esplicito
       THT_MODEL_API_KEY_FILE: /data/secrets/model_api_key   # provider key per buildPiChildEnv (codex)
+      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
+      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
+      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-server}
+      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
+      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
+      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
+      GIT_CONFIG_COUNT: "2"
+      GIT_CONFIG_KEY_0: credential.helper
+      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
+      GIT_CONFIG_KEY_1: http.sslCAInfo
+      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
+      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
       AUTH_MODE: ${AUTH_MODE:-none}
       MAX_PI_PROCESSES: ${MAX_PI_PROCESSES:-4}
     extra_hosts:
       - "host.docker.internal:host-gateway"   # Supabase :5438 + Ollama :11434 sull'host
     volumes:
       - /home/chirone/thothii-data:/data
+      - workspace-registry:/data/workspace-registry
       - /home/chirone/thothii-data/pi-config:/home/thoth/.pi
       - ${PI_AUTH_FILE:?set PI_AUTH_FILE}:/home/thoth/.pi/agent/auth.json:ro
       - /home/chirone/chirone/etl/docs/evidence:/data/evidence:ro
+      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:-/dev/null}:/run/secrets/workspace-registry-git-credentials:ro
+      - ${THT_WORKSPACE_GIT_CA_FILE:-/etc/ssl/certs/ca-certificates.crt}:/run/secrets/workspace-registry-git-ca:ro
+      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:-/dev/null}:/run/secrets/workspace-registry-git-ssh-key:ro
+      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:-/dev/null}:/run/secrets/workspace-registry-git-known-hosts:ro
     restart: unless-stopped
     networks:
       omics_portal_omics_network:
@@ -59,3 +78,6 @@ networks:
     external: true
   localllm_default:
     external: true
+
+volumes:
+  workspace-registry: