feat!: add Git version control for editing projects

[yuto-trd]

Description

• Add opt-in Git version control for Beutl editing projects: save/close snapshots, history, diffs, restore, branches, and fast-forward-only remote synchronization.
• Keep every repository mutation scoped to the project subtree, including adopted enclosing repositories, LFS objects, recovery refs, temporary indexes, hooks, and interrupted-operation recovery.
• Add the Version Control tool tab, title-bar branch picker, settings, localized guidance, and Git-unavailable degradation.
• Keep Git-specific canonical path and serialization-graph inspection internal to Beutl.Editor.VersionControl.
• Keep host composition, mutation coordination, and recovery operations internal; the plugin-facing version-control surface is read/query only.
• The branch is rebased directly onto main; review remediation is isolated in signed follow-up commits.

Frozen scope

Included here:

• Git CLI backend and project-scoped repository safety
• Git tool-tab and shell integration
• save/close/safety/restore/recovery snapshots
• branches, origin push, and fast-forward-only pull
• the four Git-friendly storage prerequisites: stable appVersion metadata, LF JSON, portable scene patterns, and ID-based element filenames
• the minimal existing-window safeguard that cancels closing when the required pre-close save is refused

Explicitly excluded from this PR:

• public output admission and AgentToolkit render leases
• public context-command completion
• public canonical filesystem APIs and non-Git consumers
• package export/resource relocation hardening
• proxy and AgentHost lifecycle redesigns
• asynchronous application shutdown redesign
• renderer census and macOS menu identity fixes
• generalized project-item migration propagation

Already-created extracted PRs target main directly and do not depend on this PR:

• docs(ai): freeze PR review scope before remediation #2313 — freeze review-remediation scope
• test(rendering): scope renderer pull API census #2314 — scope renderer pull API census
• fix(shell): resolve macOS extension menus by header #2315 — resolve macOS extension menus by header
• refactor(core)!: use canonical filesystem path identity #2316 — canonical filesystem path identity
• refactor(project-system)!: propagate persisted-content migration requirements #2317 — propagate persisted-content migrations
• refactor(extensibility)!: make context command execution awaitable #2318 — make context command execution awaitable
• refactor(extensibility)!: make output admission host-controlled #2319 — make output admission host-controlled
• fix(agent-host): treat disabled editors as unavailable sessions #2320 — treat disabled editors as unavailable AgentHost sessions
• feat(proxy): add lease-based job admission #2321 — add lease-based proxy job admission
• fix(agent-host): harden concurrent endpoint lifecycle #2323 — harden concurrent AgentHost endpoint lifecycle

Integration order (direct-to-main, not stacked)

Before this PR is merged, the output/AgentHost safety prerequisites must land independently on main, and this branch must then be rebased onto that updated main:

• refactor(extensibility)!: make output admission host-controlled #2319, after its remaining admission finding is resolved, so AgentToolkit render/export jobs participate in project replacement and teardown admission.
• fix(agent-host): treat disabled editors as unavailable sessions #2320, including its disabled-editor gateway guards.
• The independent application-shutdown change that stops new AgentHost requests, drains active requests before project close, and restores admission if close is canceled. fix(agent-host): harden concurrent endpoint lifecycle #2323 supplies the endpoint lifecycle primitive but does not by itself change window-close ordering.

This ordering keeps every PR based directly on main; there is no stacked-PR dependency chain.

Affected areas

• Beutl.Engine (rendering / scene / track)
• Beutl.ProjectSystem (project / document persistence)
• UI (Beutl.Editor, Beutl.Editor.Components, Beutl.Controls)
• Beutl.Extensibility (plugin-facing version-control query seam only)
• Beutl.NodeGraph (node editor)
• Beutl.FFmpegIpc / Beutl.FFmpegWorker (media IPC boundary)
• Beutl.Api (server API client)
• Build / CI / docs only

Breaking changes

Beutl.Core now preserves loaded project appVersion / minAppVersion until persisted content is explicitly migrated. Its shared JsonHelper / CoreSerializer options use LF line endings for projects, configuration, editor state, and every other consumer, so Windows users may observe one-time newline diffs.

No public output, context-command, canonical-path, package, AgentHost, proxy, or application-shutdown API contract is changed by this PR. A window close is canceled when the mandatory pre-close project save fails; the broader asynchronous shutdown redesign remains excluded.

The repository uses a blank squash-merge body by default. The merger must explicitly supply this trailer in the final squash commit body:

The exact footer is repeated as the final paragraph of this PR body and must be used unchanged for the squash commit.

Test plan

• dotnet build Beutl.slnx -c Debug --no-restore — passed on the final tree, 0 errors
• focused GitCliVersionControlService commit/history regressions — 72 passed
• focused Git LFS prefetch regressions — 29 passed; unavailable-filter subset re-run on the final tree
• VersionControlSnapshotScopeTests — 19 passed
• focused VersionControlRestoreTests review regressions — 5 passed
• Beutl.HeadlessUITests.VersionControlSaveTests — 16 passed
• RepositoryWatcherTests — 44 passed
• Beutl.PublicApiContractTests — 209 passed
• scoped dotnet format --verify-no-changes on the final review delta — passed
• git diff --check — passed
• GPL/MIT diff boundary scan — passed

Fixed issues / References

• Spec: docs/specs/005-project-git-versioning/

BREAKING-CHANGE: Beutl.Core now preserves loaded project appVersion and minAppVersion until explicit migration, and its shared JsonHelper and CoreSerializer output uses LF line endings for projects, configuration, editor state, and every other consumer. Windows consumers may observe one-time newline diffs.