cluster0: compose overlays lab-seed shortener; fix workspace git safe.dir

Re-copy ShortLinksRepository from NFS seed after ac-ms-* overlays;
deploy-ac-workspace allows all safe.directory; verify-mail-lab logs short URL.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/lab-seeds/backend/src/AuthMailer.php

@@ -29,10 +29,17 @@ final class AuthMailer {
         $subject = 'Verify your Android Cast account';
         $shortUrl = $verifyUrl;
         $qrImageUrl = null;
-        if (class_exists('ShortLinksRepository', false)) {
+        if (is_callable(['ShortLinksRepository', 'shortenForOutboundMail'])) {
             $pack = ShortLinksRepository::shortenForOutboundMail($verifyUrl, 86400);
             $shortUrl = (string) ($pack['short_url'] ?? $verifyUrl);
             $qrImageUrl = (string) ($pack['qr_image_url'] ?? '');
+            if ($qrImageUrl === '' && preg_match('#/([a-f0-9]{6,16})$#', $shortUrl, $m)) {
+                $qrImageUrl = preg_replace(
+                    '#/([a-f0-9]{6,16})$#',
+                    '/api/v1/qr/' . $m[1] . '.png',
+                    $shortUrl
+                );
+            }
             if ($qrImageUrl === '') {
                 $qrImageUrl = null;
             }

sim/cluster0/scripts/compose-lab-backend.sh

@@ -85,6 +85,17 @@ overlay_src ac-ms-tickets
 overlay_src ac-ms-graphs
 overlay_src ac-ms-remote-access
 
+# Lab-seed PHP not yet split into ac-ms-* repos — NFS seed stays authoritative after overlays.
+overlay_lab_seed_src() {
+  _f="$1"
+  if [ -f "${LEGACY}/src/${_f}" ]; then
+    log "overlay lab-seed src ${_f}"
+    cp -a "${LEGACY}/src/${_f}" "${COMPOSED}/src/"
+  fi
+}
+overlay_lab_seed_src ShortLinksRepository.php
+overlay_lab_seed_src UrlShortenerDatabase.php
+
 overlay_api ac-ms-identity
 overlay_api ac-ms-rbac
 overlay_api ac-ms-devices

sim/cluster0/scripts/deploy-ac-workspace.sh

@@ -13,6 +13,7 @@ SUBS="${AC_SUBMODULES_CORE:-ac-platform-db ac-platform-php ac-platform-web ac-pl
 
 mkdir -p "$(dirname "$AC_ROOT")"
 git config --global --add safe.directory "$AC_ROOT" 2>/dev/null || true
+git config --global --add safe.directory '*' 2>/dev/null || true
 
 if [ -d "${AC_ROOT}/.git" ]; then
   log "ac-workspace pull ${BRANCH} in ${AC_ROOT}"

sim/cluster0/scripts/verify-mail-lab.sh

@@ -24,11 +24,16 @@ _out="$("$PHP" -r '
 require "'"${COMPOSED}"'/src/bootstrap.php";
 $to = getenv("MAIL_TEST_TO") ?: "";
 $long = getenv("MAIL_TEST_LONG") ?: "";
+$short = $long;
+if (is_callable(["ShortLinksRepository", "shortenForOutboundMail"])) {
+    $pack = ShortLinksRepository::shortenForOutboundMail($long, 86400);
+    $short = (string) ($pack["short_url"] ?? $long);
+}
 $ok = AuthMailer::sendVerifyEmail($to, $long);
-echo $ok ? "mail_ok" : "mail_fail";
+echo ($ok ? "mail_ok" : "mail_fail") . " short=" . $short;
 ' 2>&1)" || _out="mail_fail"
 
-log "$_out to=$TO short=$(echo "$_long" | sed 's/token=.*/token=…/')"
+log "$_out to=$TO"
 if echo "$_out" | grep -q mail_ok; then
   log "hint: expect s.f0xx.org short link + inline QR via s.f0xx.org/api/v1/qr/…png (encodes …&src=qr)"
 fi