fix: grant default repository credential write access

crates/workspace-server/src/repository_access.rs

@@ -1123,7 +1123,7 @@ impl RepositorySecretService {
             repository_key: repository_key.to_string(),
             credential_id: WORKSPACE_DEFAULT_REPOSITORY_SSH_CREDENTIAL_ID.to_string(),
             host_trust_id: host_trust.host_trust_id.clone(),
-            access: RepositoryAccessMode::ReadOnly,
+            access: RepositoryAccessMode::ReadWrite,
         }))
     }
 
@@ -2377,7 +2377,7 @@ mod tests {
     }
 
     #[test]
-    fn default_binding_resolves_unique_host_trust_for_url_and_scp_ssh_sources() {
+    fn default_binding_is_read_write_for_unique_host_trust_and_ssh_sources() {
         let (_dir, _store, service) = test_service();
         assert!(
             service
@@ -2418,7 +2418,7 @@ mod tests {
                 WORKSPACE_DEFAULT_REPOSITORY_SSH_CREDENTIAL_ID
             );
             assert_eq!(binding.host_trust_id, "example");
-            assert_eq!(binding.access, RepositoryAccessMode::ReadOnly);
+            assert_eq!(binding.access, RepositoryAccessMode::ReadWrite);
         }
         assert!(
             service

web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte

@@ -293,7 +293,7 @@
     <div><p class="eyebrow">owner only</p><h2>Repository Access</h2></div>
     <span class="badge success">encrypted</span>
   </header>
-  <p>The Workspace default SSH key is generated separately from the Runtime authentication identity and is always offered during SSH clone. Without an explicit Repository binding, a unique pinned host trust matching the Repository URI is used with this default key. A binding can add one dedicated credential; OpenSSH receives both candidates and tries them through one operation-scoped agent. Private keys and passphrases remain write-only.</p>
+  <p>The Workspace default SSH key is generated separately from the Runtime authentication identity and is always offered during SSH clone. Without an explicit Repository binding, a unique pinned host trust matching the Repository URI is used with this default key and normal read/write Git access. An explicit binding can select read-only access or add one dedicated credential; OpenSSH receives both credential candidates and tries them through one operation-scoped agent. Private keys and passphrases remain write-only.</p>
   {#if message}<p class="status-message">{message}</p>{/if}
 
   <div class="settings-runtime-list">

web/workspace/test/repository-access/ui.test.ts

@@ -77,6 +77,8 @@ test("Repository Access generates and copies selectable public keys", () => {
       "publicKeys[credential.credential_id]",
       "workspace-default",
       "always offered during SSH clone",
+      "normal read/write Git access",
+      "explicit binding can select read-only access",
     ]
   ) {
     assert(