calm-hub: GitHub clone-directory defaults to /tmp and isValidRepo trusts any pre-existing .git dir

`calm.github.clone-directory` defaults to `/tmp/calm-hub-clones`. `GitHubRepoSync.isValidRepo` only checks for a `.git` subdirectory — it never verifies the repo's `origin` matches the namespace it's meant to serve. On a shared host, an attacker who pre-creates `/tmp/calm-hub-clones//.git` pointing `origin` at their own repo gets the service token on the first sync (`pullRepo` fetches with the service token as credentials against whatever `origin` is configured, not the one calm-hub set up).

**Fix**: default `clone-directory` to somewhere not world-writable shared temp space, and/or have `isValidRepo` (or the caller) verify the existing repo's `origin` remote matches the expected `repoFullName`/`githubBaseUrl` before trusting it and pulling with the service token.

(Surfaced during #3066's review.)

Start with the calm.github.clone-directory configuration and GitHubRepoSync.isValidRepo, then trace how pullRepo chooses and authenticates the origin. Check the review context in #3066 and add or locate tests for an existing clone with an unexpected origin. Done means shared temporary paths are not used by default and an untrusted origin cannot be fetched with the service token.

Written by the indexing model from the issue text.