Managed run branches and validation fixes

Managed run branch controls

Fabro-managed Git behavior can now be controlled at the run level instead of through provider-specific sandbox switches. Workflows can opt out of automatic cloning, run branch setup, branch pushes, metadata branch writes, and metadata pushes while keeping the default behavior unchanged for existing runs.

[run.clone]
enabled = false

[run.run_branch]
enabled = false

[run.meta_branch]
enabled = false

This is useful for workflows that prepare their own workspace, run against already-mounted files, or should avoid pushing Fabro-managed branches back to GitHub. Pull request creation still validates that a pushed run branch is enabled before it proceeds.

More

Workflows

• Added [run.clone], [run.run_branch], and [run.meta_branch] settings for clone, branch, and metadata branch behavior
• Added provider-scoped [llm.providers.<id>.models.<slug>] settings foundations for configurable provider and model catalog data
• Added typed provider extra_headers settings for gateway-backed LLM providers

CLI

• fabro validate path/to/workflow.fabro now discovers a sibling workflow.toml when it points back to the same graph and supplies [run.inputs]

Fixes

• Fixed local sandbox startup on NixOS by resolving bash through PATH instead of requiring /bin/bash
• Fixed ACP stdio handling so a clean process exit after the final response is tolerated
• Fixed templated .fabro validation by ignoring unrelated sibling workflow.toml files in the same directory