cluster0: sync ac-workspace and url-shortener on lab deploy

Add deploy-ac-workspace, deploy-ac-url-shortener, validate-ac-repos;
wire into populate app phase and verify_lab_setup.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/deploy-ac-workspace.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Clone/update ac-workspace and core ac/* submodules (lab local disk).
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+. "$ROOT/scripts/lib/common.sh"
+load_cluster_env
+
+AC_ROOT="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}"
+ORIGIN="${AC_WORKSPACE_ORIGIN:-git://f0xx.org/ac/ac-workspace}"
+BRANCH="${AC_GIT_BRANCH:-next}"
+SUBS="${AC_SUBMODULES_CORE:-ac-platform-db ac-platform-php ac-platform-web ac-platform-edge ac-deploy ac-docs ac-scripts ac-ms-url-shortener ac-be-hub ac-ms-identity}"
+
+mkdir -p "$(dirname "$AC_ROOT")"
+git config --global --add safe.directory "$AC_ROOT" 2>/dev/null || true
+
+if [ -d "${AC_ROOT}/.git" ]; then
+  log "ac-workspace pull ${BRANCH} in ${AC_ROOT}"
+  git -C "$AC_ROOT" fetch origin
+  git -C "$AC_ROOT" checkout "$BRANCH"
+  git -C "$AC_ROOT" pull --ff-only origin "$BRANCH" || git -C "$AC_ROOT" reset --hard "origin/${BRANCH}"
+else
+  log "ac-workspace clone ${ORIGIN} → ${AC_ROOT}"
+  rm -rf "$AC_ROOT"
+  git clone --branch "$BRANCH" --depth 1 "$ORIGIN" "$AC_ROOT"
+fi
+
+cd "$AC_ROOT"
+log "submodule init: ${SUBS}"
+# shellcheck disable=SC2086
+git submodule update --init --depth 1 $SUBS
+
+chown -R nginx:nginx "$(dirname "$AC_ROOT")" 2>/dev/null || true
+log "deploy-ac-workspace_ok $(host_short) $(git -C "$AC_ROOT" rev-parse --short HEAD)"