feat(home): landing-page agent + plain clone URL support

[rafavalls]

What is this contribution about?

Adds a "Build landing page" tile on the home page that creates a vMCP pre-wired to the Next.js + shadcn template and eagerly fires VM_START so the preview is ready by the time the user arrives. Generalises repo-backed vMCPs to also accept a plain cloneUrl (no GitHub OAuth required) with unauthenticated runtime detection for public github.com URLs, and threads the new source through preview-tab gating, branch resolution, and stream-core VM keying. Also includes sandbox host-runner stability fixes — PTY-to-pipe spawn fallback with env merge, retry on posix_spawn errors during clone, child_process.spawn for setup steps — plus dynamic ingress port autoselection and a credentials-file refresher for the s3-sync daemon so subshells share STS creds.

How to Test

1. From the home page, click "Build landing page" — confirm the agent opens with the preview tab active and the dev server boots without manual interaction.
2. On a vMCP whose metadata has cloneUrl set (and no githubRepo), confirm the preview tab and per-branch VM keying still work, and that the displayed clone URL has any embedded user:token@ credentials stripped.
3. Run multiple parallel Conductor workspaces with the host runner — confirm each picks a distinct sandbox-ingress port instead of failing on EADDRINUSE.

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working
• Documentation is updated (if needed)
• No breaking changes

---

Summary by cubic

Adds a “Build landing page” tile that spins up a Next.js + shadcn template with an eager VM_START, and adds plain cloneUrl support so repo-backed agents work without GitHub OAuth. Also hardens the sandbox runner and auto-picks a free local ingress port to keep preview reliable.

• New Features

  • New home tile: creates a vMCP pre-wired to the shadcn Next.js template, opens with Preview, and starts the dev server automatically.
  • Repo via cloneUrl: supports public GitHub URLs without auth, detects package manager and dev port via unauthenticated API, strips any user:token@ from display, and updates branch resolution + VM keying to treat cloneUrl like githubRepo.
  • Preview UI: Preview tab appears when the agent has any repo source (GitHub link or cloneUrl).

• Stability

  • Host runner: falls back from PTY to pipe spawn with env merge on spawn errors, runs setup steps with child_process.spawn, and retries clone on posix_spawn failures.
  • Ingress: finds a free local port and sets SANDBOX_INGRESS_PORT to avoid EADDRINUSE when multiple workspaces run.
  • S3 sync: shares STS creds via a file with a background refresher; cleans up on shutdown.

^{Written for commit b839c24. Summary will update on new commits.}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Suggested: Minor (2.325.0) — based on feat: prefix

React with an emoji to override the release type:

Reaction	Type	Next Version
👍	Prerelease	2.324.2-alpha.1
🎉	Patch	2.324.2
❤️	Minor	2.325.0
🚀	Major	3.0.0

Current version: 2.324.1

Note: If multiple reactions exist, the smallest bump wins. If no reactions, the suggested bump is used (default: patch).