fix(autotrader): checkout repo for readback runner

[gregkonush]

Summary

• Makes the dedicated autonomous-trader readback runner shallow-checkout the lab repo before invoking repo-owned Python helpers.
• Uses the controller-provided read-only VCS environment and token via a temporary GIT_ASKPASS helper.
• Adds smoke-test assertions for the checkout path while preserving the no-analysis-clone readback lane.

Related Issues

None

Testing

• bun test packages/scripts/src/agents/__tests__/smoke-agents.test.ts -t "schedules a post-close scorecard readback proof without broker mutations"
• kubectl kustomize argocd/applications/autotrader
• bunx oxfmt --check packages/scripts/src/agents/__tests__/smoke-agents.test.ts
• git diff --check
• bun run lint:argocd
• ruby -ryaml -e 'docs = YAML.load_stream(File.read("argocd/applications/autotrader/autonomous-trader-readback-agentprovider.yaml")); provider = docs.find { |doc| doc["kind"] == "AgentProvider" }; script = provider["spec"]["inputFiles"].find { |f| f["path"] == "/root/autonomous-trader-scorecard-readback.sh" }["content"]; File.write("/tmp/autonomous-trader-scorecard-readback.sh", script)' && bash -n /tmp/autonomous-trader-scorecard-readback.sh

Screenshots (if applicable)

N/A

Breaking Changes

None

Checklist

• Testing section documents the exact validation performed (or N/A with justification).
• Screenshots and Breaking Changes sections are handled appropriately (removed or filled in).
• Documentation, release notes, and follow-ups are updated or tracked.