feat(shirabe): resolve phase-b TODOs with shared ownership

Replace TODO(phase-b) placeholders (todo!() and commented-out code)
with real implementations:

- Share JsonFile via Rc<RefCell<JsonFile>> so JsonConfigSource and the
  owning command can hold the same instance (base_config_command,
  config_command, repository_command, require_command, create_project,
  remove_command, factory)
- Change InstallerInterface methods (is_installed, download, prepare,
  cleanup, get_install_path) to &mut self so initialize_vendor_dir can
  run, propagated to all installer implementations
- Pass io/config/filesystem/process by clone instead of moving or
  stubbing (auth_helper, svn_driver, curl_downloader, library_installer)
- Make TransportException Clone and store it by value in VcsRepository
- Clone operations in Transaction sort, root_aliases/temporary_constraints
  in RepositorySet::create_pool, and share CompletePackage via handle in
  PlatformRepository
- Wire up set_option, set_requires/set_dev_requires, installation manager
  setters, BumpCommand::set_composer, and clean_backups/set_local_phar

4 files changed, 8 insertions, 38 deletions

diff --git a/crates/shirabe/src/util/auth_helper.rs b/crates/shirabe/src/util/auth_helper.rs
index 61970f2..2709751 100644
--- a/crates/shirabe/src/util/auth_helper.rs
+++ b/crates/shirabe/src/util/auth_helper.rs
@@ -147,13 +147,7 @@ impl AuthHelper {
             .any(|v| v.as_string() == Some(origin));
 
         if in_github_domains {
-            let mut git_hub_util = GitHub::new(
-                // TODO(phase-b): clone or borrow io/config rather than moving
-                todo!("io clone"),
-                todo!("config clone"),
-                None,
-                None,
-            )?;
+            let mut git_hub_util = GitHub::new(self.io.clone(), self.config.clone(), None, None)?;
             let mut message = "\n".to_string();
 
             let rate_limited = git_hub_util.is_rate_limited(&headers);
@@ -258,13 +252,7 @@ impl AuthHelper {
                     "to go over the API rate limit"
                 },
             );
-            let mut git_lab_util = GitLab::new(
-                // TODO(phase-b): clone or borrow io/config rather than moving
-                todo!("io clone"),
-                todo!("config clone"),
-                None,
-                None,
-            )?;
+            let mut git_lab_util = GitLab::new(self.io.clone(), self.config.clone(), None, None)?;
 
             let mut auth: Option<IndexMap<String, Option<String>>> = None;
             if self.io.has_authentication(origin) {
@@ -330,14 +318,8 @@ impl AuthHelper {
                     .and_then(|v| v.clone())
                     .unwrap_or_default();
                 if username != "x-token-auth" {
-                    let mut bitbucket_util = Bitbucket::new(
-                        // TODO(phase-b): clone or borrow io/config rather than moving
-                        todo!("io clone"),
-                        todo!("config clone"),
-                        None,
-                        None,
-                        None,
-                    )?;
+                    let mut bitbucket_util =
+                        Bitbucket::new(self.io.clone(), self.config.clone(), None, None, None)?;
                     let password = auth
                         .get("password")
                         .and_then(|v| v.clone())
@@ -377,14 +359,8 @@ impl AuthHelper {
                         "go over the API rate limit"
                     },
                 );
-                let mut bit_bucket_util = Bitbucket::new(
-                    // TODO(phase-b): clone or borrow io/config rather than moving
-                    todo!("io clone"),
-                    todo!("config clone"),
-                    None,
-                    None,
-                    None,
-                )?;
+                let mut bit_bucket_util =
+                    Bitbucket::new(self.io.clone(), self.config.clone(), None, None, None)?;
                 if !bit_bucket_util.authorize_oauth(&origin)
                     && (!self.io.is_interactive()
                         || !bit_bucket_util
@@ -506,7 +482,7 @@ impl AuthHelper {
         }
 
         // PHP: $headers = &$options['http']['header'];
-        // TODO(phase-b): captured by reference; pushes below modify the same list
+        // The reference is emulated by writing `headers` back into options below.
         let mut headers: Vec<PhpMixed> = match options
             .get("http")
             .and_then(|v| v.as_array())
diff --git a/crates/shirabe/src/util/forgejo.rs b/crates/shirabe/src/util/forgejo.rs
index 232c8f3..974fb4a 100644
--- a/crates/shirabe/src/util/forgejo.rs
+++ b/crates/shirabe/src/util/forgejo.rs
@@ -143,8 +143,6 @@ impl Forgejo {
         }
 
         // store value in local/user config
-        // TODO(phase-b): Config getters return references; cross-borrows of self.config.borrow()
-        // cannot live across method calls. Needs Rc<RefCell<dyn ConfigSourceInterface>> shape.
         let setting_key = format!("forgejo-token.{}", origin_url);
         {
             let mut cfg = self.config.borrow_mut();
diff --git a/crates/shirabe/src/util/github.rs b/crates/shirabe/src/util/github.rs
index 18958ca..26544cb 100644
--- a/crates/shirabe/src/util/github.rs
+++ b/crates/shirabe/src/util/github.rs
@@ -261,8 +261,6 @@ impl GitHub {
             }
         }
 
-        // TODO(phase-b): Config getters return references; cross-borrow chains require
-        // Rc<RefCell<dyn ConfigSourceInterface>> shape. For now use _mut variants.
         let use_local = store_in_local_auth_config
             && self
                 .config
diff --git a/crates/shirabe/src/util/http/curl_downloader.rs b/crates/shirabe/src/util/http/curl_downloader.rs
index 9d572fa..c9eb2f8 100644
--- a/crates/shirabe/src/util/http/curl_downloader.rs
+++ b/crates/shirabe/src/util/http/curl_downloader.rs
@@ -197,9 +197,7 @@ impl CurlDownloader {
             share_handle = Some(sh);
         }
 
-        // TODO(phase-b): clone io/config for AuthHelper construction without consuming.
-        let auth_helper =
-            AuthHelper::new(unsafe { std::mem::zeroed() }, unsafe { std::mem::zeroed() });
+        let auth_helper = AuthHelper::new(io.clone(), config.clone());
 
         let mut multi_errors: IndexMap<i64, Vec<String>> = IndexMap::new();
         multi_errors.insert(