fix(clone): a CodeCommit region borrows saved key IDs; Clone runs in the background

An IAM SSH key ID logs in to every region of its AWS account, but a login
was saved per host, so a repo in a region with no key ID of its own was
refused. Clone now tries the key IDs saved for the other CodeCommit regions
(each with its own key; the first ls-remote accepts, or the only one) and
keeps that user in the clone's origin.

Files → New → Clone repository steps aside for its progress chip as soon
as the clone starts; a failure asking for a login reopens the form.

server/lib/git-identity.js

@@ -715,6 +715,42 @@ async function linkedKeyFile(account, url) {
   return row ? (currentKeys(account).find((k) => k.id === row.key)?.file ?? null) : null;
 }
 
+// AWS CodeCommit's SSH key ID belongs to an IAM user, so it logs in to EVERY
+// region of that AWS account — but our login rules are per host, and a repo
+// in a region the user never saved stayed refused. Such a clone borrows the
+// logins saved for the other CodeCommit regions (not aliases' hosts only: an
+// alias row's user is as valid), each with its own key when it names one.
+const CODECOMMIT_RE = /^git-codecommit\.[a-z0-9-]+\.amazonaws\.com$/;
+
+/** `[{url, keyFile}]`: `url` with each borrowable CodeCommit user in it. */
+async function borrowedLogins(account, url) {
+  if (!url.startsWith("ssh://")) return [];
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return [];
+  }
+  const host = u.host.toLowerCase();
+  if (u.username || !CODECOMMIT_RE.test(host)) return [];
+  const rows = await listSshUsers(account);
+  // The region has a login of its own: git's insteadOf already applies it.
+  if (rows.some((r) => (r.alias ?? r.host) === host)) return [];
+  const keys = currentKeys(account);
+  const seen = new Set();
+  const out = [];
+  for (const r of rows) {
+    if (!CODECOMMIT_RE.test(r.host)) continue;
+    const keyFile = r.key ? (keys.find((k) => k.id === r.key)?.file ?? null) : null;
+    if (r.key && !keyFile) continue;
+    const id = `${r.user}\0${keyFile ?? ""}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push({ url: `ssh://${r.user}@${host}${u.pathname}`, keyFile });
+  }
+  return out;
+}
+
 // ── Network commands in an existing repo (git bar fetch/pull/push) ─────────
 
 /**
@@ -878,12 +914,35 @@ async function cloneNow({ url, parent, name, once = null, partial = false }, thr
     if (once) throw err("EBADCRED", "a typed login is for https only — SSH uses your key");
     // A login naming its key (another AWS account, a second GitHub user)
     // offers that key ONLY — another key could log in as the wrong account.
-    const linked = await linkedKeyFile(account, url);
+    let linked = await linkedKeyFile(account, url);
+    const sshFor = (file) => {
+      const k = file ? [file] : keyFiles(account);
+      const b = k.length ? `ssh${identityArgs(k)} -o IdentitiesOnly=yes` : "ssh";
+      // BatchMode: no terminal to answer a prompt; accept-new: first contact
+      // records the host key, a CHANGED one still fails.
+      return `core.sshCommand=${b} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+    };
+    // A CodeCommit region with no login of its own: the first borrowed login
+    // the remote accepts (one is taken as is). The clone's URL then names
+    // that user, so the repo's `origin` keeps logging in the same way.
+    const borrowed = await borrowedLogins(account, url);
+    for (const b of borrowed) {
+      const ok =
+        borrowed.length === 1 ||
+        (await git(parent, ["-c", sshFor(b.keyFile), "ls-remote", "--", b.url, "HEAD"], {
+          timeout: 60_000,
+        }).then(
+          () => true,
+          () => false
+        ));
+      if (ok) {
+        url = b.url;
+        linked = b.keyFile;
+        break;
+      }
+    }
     const keys = linked ? [linked] : keyFiles(account);
-    const base = keys.length ? `ssh${identityArgs(keys)} -o IdentitiesOnly=yes` : "ssh";
-    // BatchMode: no terminal to answer a prompt; accept-new: first contact
-    // records the host key, a CHANGED one still fails.
-    pre.push("-c", `core.sshCommand=${base} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`);
+    pre.push("-c", sshFor(linked));
     if (keys.length) {
       // Persisted by FILE name — both default types plus every named key:
       // a default key made later is offered too (ssh skips a missing