Fix every failed clone being reported as a timeout

The context was cancelled before its error was checked, so any failure
looked like a timeout and private repositories never offered sign-in.
Clone handling moves into cloneRepo, which checks for DeadlineExceeded
specifically, with tests for success, failure with token masking, and
timeout.

main.go

@@ -3,7 +3,6 @@ package main
 import (
 	"bufio"
 	"bytes"
-	"context"
 	"crypto/rand"
 	"embed"
 	"encoding/json"
@@ -50,10 +49,13 @@ const (
 	idleExpiry   = time.Hour // snapshots unused and jobs untouched for this long are dropped
 	maxSnapshots = 8         // ponytail: fixed caps sized for the 2GB container; make them configurable if memory changes
 	maxIndexing  = 2         // concurrent index runs; each already uses every CPU
-	cloneTimeout = 10 * time.Minute
 )
 
-var sseKeepAlive = 15 * time.Second // variable so tests can shorten it
+// Variables so tests can shorten them.
+var (
+	sseKeepAlive = 15 * time.Second
+	cloneTimeout = 10 * time.Minute
+)
 
 type Server struct {
 	jobsMu      sync.Mutex
@@ -188,17 +190,7 @@ func (s *Server) createJob(w http.ResponseWriter, r *http.Request) {
 		token := s.githubAuthFor(owner).token
 		go func() {
 			checkout := filepath.Join(root, "repo")
-			ctx, cancel := context.WithTimeout(context.Background(), cloneTimeout)
-			output, err := gitClone(ctx, url, checkout, token).CombinedOutput()
-			cancel()
-			if err != nil {
-				text := string(output)
-				if ctx.Err() != nil {
-					text = "timed out after " + cloneTimeout.String()
-				}
-				if token != "" {
-					text = strings.ReplaceAll(text, token, "***")
-				}
+			if text, err := cloneRepo(url, checkout, token); err != nil {
 				message, authRequired := s.github.cloneFailure(text, token != "")
 				s.failJob(id, message, authRequired)
 				s.removeWorkspace(root)