# DEVX-166: create_dependency_pr must clone the target repo

## Problem

`create_dependency_pr` resolves the pinned-version file and runs all
git operations in the current working directory. Producer post-merge
workflows (grm, sso-bridge) invoke it from the *producer* checkout, so
it searches/modifies the wrong repository: `find_pinned_version` reads
files that do not exist there, and the git fetch/checkout/commit/push
sequence runs in the producer clone. The failure is silent — producer
workflows append `|| echo warning`, so a no-op looks like success.

## Approach

REQ-1: Clone the target repo (`--repo`) into a temporary directory with
an authenticated `http.extraHeader`, then run every file lookup and git
operation (fetch, checkout, add, commit, push) inside that clone. The
push uses the same auth header config.

REQ-2: Tests mock `subprocess.run` so no real clone happens in the unit
suite (test-isolation gate).

## Files Affected

- `src/devx/ci/create_dependency_pr.py`
- `tests/unit/test_create_dependency_pr.py`

## Test Plan

- Existing CLI tests keep passing with the subprocess mock in place.
- Verify the clone command targets the `--repo` URL and that git ops
  run with `cwd=<clone>` (asserted via the mock's call list).

## Deploy Plan

Merge via auto-merge after green CI. The fix takes effect the next time
a producer post-merge workflow invokes `create_dependency_pr`.

## Rollback Plan

Revert the squash-merge commit on master; the previous (broken) CWD
behavior returns, which is strictly worse — no state is created.

## Acceptance Criteria

- [x] REQ-1: target repo cloned to tempdir; all file/git ops run in the clone
- [x] REQ-2: unit tests never spawn a real git subprocess