feat(app): wire workspace module + integration test for ws closed loop

internal/workspace/workspace_service.go

@@ -116,7 +116,9 @@ func (s *workspaceService) Create(ctx context.Context, c Caller, projectSlug str
 	}
 
 	s.audit(ctx, &c.UserID, "workspace.create", "workspace", wsID.String(), map[string]any{"slug": in.Slug})
-	s.clones.Schedule(wsID)
+	if s.clones != nil {
+		s.clones.Schedule(wsID)
+	}
 	return created, nil
 }
 
@@ -304,6 +306,28 @@ func (s *workspaceService) encryptForUpsert(wsID uuid.UUID, in UpsertCredentialI
 	return cred, nil
 }
 
+// CredentialAccessor 让 app 装配代码不重复实现凭据加载。
+// CloneRunner 与 GitOpsService 都通过这个窄接口拿明文 git.Credential。
+type CredentialAccessor interface {
+	LoadDecryptedCredential(ctx context.Context, wsID uuid.UUID) (*git.Credential, error)
+}
+
+// SchedulerSetter 让 app 装配代码在创建 cloneRunner 后回填到 service。
+// NewWorkspaceService 阶段允许传 nil scheduler；构造完 cloneRunner 再 SetScheduler。
+type SchedulerSetter interface {
+	SetScheduler(s CloneScheduler)
+}
+
+// LoadDecryptedCredential 暴露 loadDecryptedCredential 给 app 装配代码（CloneRunner、GitOps 共用）。
+func (s *workspaceService) LoadDecryptedCredential(ctx context.Context, wsID uuid.UUID) (*git.Credential, error) {
+	return s.loadDecryptedCredential(ctx, wsID)
+}
+
+// SetScheduler 在装配链路把后构造的 CloneRunner 回填到 service（NewWorkspaceService 阶段允许 nil）。
+func (s *workspaceService) SetScheduler(sched CloneScheduler) {
+	s.clones = sched
+}
+
 func (s *workspaceService) loadDecryptedCredential(ctx context.Context, wsID uuid.UUID) (*git.Credential, error) {
 	cred, err := s.repo.GetCredentialByWorkspace(ctx, wsID)
 	if err != nil {