Complete roadmap optionals: Holesail, Swarm UI, GitOps, virtualization.

Add tunnel persistence and container one-click tunnels with local
Holesail client bind, Swarm services/nodes/tasks view, GitOps stack
sync from git, deploy wizard step chrome, virtualized container lists,
and structure regression tests. Mark Tracks A–D and optional future done.

test/gitops.test.js

@@ -0,0 +1,13 @@
+import test from 'brittle'
+import { fetchComposeFromGit } from '../server/utils/gitops.js'
+
+test('fetchComposeFromGit rejects bad URLs', async (t) => {
+  await t.exception(() => fetchComposeFromGit({ repoUrl: '' }))
+  await t.exception(() => fetchComposeFromGit({ repoUrl: 'ftp://evil' }))
+  await t.exception(() =>
+    fetchComposeFromGit({
+      repoUrl: 'https://example.com/x.git',
+      composePath: '../etc/passwd',
+    })
+  )
+})