Release 2.1.56 (2026-06-23)

Bug fixes

• allow 'git clone' in vrg-git for off-platform volume bootstrap (#1781) The off-platform bootstrap_volume runs 'vrg-git clone ' on the cloud box, but vrg-git's allowlist had no 'clone' — it was rejected before git ran, failing the create at bootstrap-volume after provisioning, credentials, and tooling all succeeded.

Add 'clone' to _ALLOWED_SIMPLE (allow the subcommand) and to _REMOTE_SUBCOMMANDS (so main() injects the identity's installation token via _git_auth_env). Auth is host-level (http.https://github.com/.extraHeader) and identity-based, so it works for a clone run outside any repo. The other gates are already clone-safe: clone is not in _FLAG_DENY, and _check_worktree_convention returns early for anything outside {checkout, switch}. No new exposure — clone reaches exactly the repos the identity's push/pull/fetch token already can.