bundle git via dugite-native (D-59)

macOS sandbox blocks Homebrew git execution (symlinks resolve to Cellar
paths that SBPL cannot match). Bundled dugite-native — the same
relocatable Git distribution GitHub Desktop ships.

make dugite-fetch downloads the platform tarball to native/dugite/.
Toolchain checks the bundled binary first, sets GIT_EXEC_PATH and
GIT_TEMPLATE_DIR automatically. native/dugite/ is gitignored (57 MB
compressed).

Decision D-59 in tooling.md, dependency entry in licenses.yaml
(GPL-2.0 for the git binary, MIT for dugite-native build scripts).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

assets/licenses.yaml

@@ -109,6 +109,18 @@ dependencies:
       the core PTY wrapper for libc bindings (socketpair, recvmsg with
       SCM_RIGHTS, ioctl). Dart-team maintained; zero transitive deps.
 
+  - name: dugite-native (Git)
+    kind: native-binary
+    version: "2.53.0"
+    homepage: https://github.com/desktop/dugite-native
+    license: GPL-2.0 (Git), MIT (dugite-native build scripts)
+    purpose: >-
+      Self-contained, relocatable Git distribution for macOS/Linux/Windows.
+      Bundled so clide can run git inside the macOS app sandbox without
+      depending on Homebrew or Xcode Command Line Tools. Same approach
+      used by GitHub Desktop and Tower. Binary not committed — downloaded
+      at build time via `make dugite-fetch`.
+
   - name: tree-sitter
     kind: native-shared-lib
     version: "0.26.8"