Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/gitlawb-node/src/sync.rs`:
- Around line 66-72: The shared reqwest client is created with
reqwest::Client::new() and can hang the sync worker; create the Client with a
default timeout (e.g. via Client::builder().timeout(...).build()) and also wrap
the call in fetch_withheld() with tokio::time::timeout(...) to bound individual
/withheld-paths requests; additionally fix Promisor→Plain rehydration in
classify_mirror()/fetch_repo(): when classify_mirror() yields MirrorMode::Plain
ensure fetch_repo clears remote.origin.promisor and
remote.origin.partialclonefilter (remove or set to None/empty) so an existing
promisor mirror is converted to a full/plain mirror, and add unit/integration
tests that transition a repo from Promisor to Plain to assert those fields are
cleared and rehydration completes.
- Around line 235-257: fetch_repo currently only sets promisor config when mode
== MirrorMode::Promisor but never clears it when classify_mirror determines the
repo moved from Promisor → Plain; update fetch_repo to detect that transition
(use the computed mode from classify_mirror) and when switching to Plain
explicitly unset remote.origin.promisor and remove
remote.origin.partialclonefilter (run git config --unset or set to false/empty
for remote.origin.promisor and git config --unset for
remote.origin.partialclonefilter), then ensure the mirror is rehydrated (e.g.,
trigger a reclone or run the rehydrate logic you use elsewhere) so that stored
promisor state does not leave the mirror incomplete; reference functions/keys:
fetch_repo, classify_mirror, and git config keys remote.origin.promisor and
remote.origin.partialclonefilter.

In `@crates/gitlawb-node/src/visibility.rs`:
- Around line 122-169: reincluded_globs currently collects two unordered buckets
(denied then allowed) which loses nesting order; change its contract to produce
an ordered sequence that preserves rule specificity (e.g., return a Vec<(String,
bool)> or Vec<PatternOp> where bool=true means include and false means exclude)
instead of only allowed globs, implement the logic by iterating over the
original rules in order and for each non-root rule computing Decision via
visibility_check(glob_prefix(&r.path_glob)) and emitting the corresponding
(r.path_glob.clone(), Decision::Allow) or (r.path_glob.clone(), Decision::Deny)
entry so the final sparse-checkout operations maintain the same ordering as the
rules, and add a regression test that applies the three-level scenario
("/secret/**" deny, "/secret/public/**" allow, "/secret/public/admin/**" deny)
to assert the emitted sequence/materialized patterns do not re-include the
deepest denied path.

In `@crates/gl/src/clone.rs`:
- Around line 133-145: In the branch==None clone path, stop calling and parsing
`git remote show origin`; instead read the local ref file
`refs/remotes/origin/HEAD` under the cloned repo (use `dest`), resolve it to the
target branch name and pass that to `git(dest, &["checkout", "-q", &head])` so
default-branch detection is local and robust (replace the Command::new("git")...
block). In `fetch_withheld` (the JSON parsing path that currently uses
`unwrap_or_default()` on `withheld`/`reinclude`), validate that
`Value::get("withheld")` and `Value::get("reinclude")` exist and are arrays (or
return a clear error) and parse their string entries explicitly instead of
defaulting to empty arrays; fail-fast on schema/type mismatches to preserve the
contract described in the doc comment.
- Around line 192-206: fetch_withheld currently tolerates missing/wrong-typed
"withheld" or "reinclude" by falling back to empty Vec, which can silently force
a full clone; update fetch_withheld to validate the response schema and fail on
mismatch: instead of the permissive globs closure, extract both fields from the
parsed JSON and attempt to deserialize each into Vec<String> (e.g. via
serde_json::from_value or .as_array() plus string-checks) and return an error
(with context) if a field is missing or not an array of strings; keep references
to the same symbols (fetch_withheld, the "withheld"/"reinclude" fields and the
behavior consumed by setup_partial_clone) so callers get an Err on schema
mismatch rather than treated as empty lists.