refactor: Extract raw SQL from routers/git.py to db layer (Invariant #1)

[vybe]

Problem

src/backend/routers/git.py:315 executes raw SQL directly against the DB, bypassing the service/db layer. Violates Architectural Invariant #1 (Three-Layer Backend: Router → Service → DB).

db.execute_query("DELETE FROM agent_git_config WHERE agent_name = ?", (agent_name,))

Context: orphan cleanup when agent has a DB row but no git config in the container.

Scope

• Add a delete_agent_git_config(agent_name) operation to src/backend/db/git.py (or equivalent operations class used by git_service).
• Call it from routers/git.py instead of the raw db.execute_query(...).
• No behavior change.

Out of scope

Process engine router SQL (routers/processes.py, routers/triggers.py) — the Process Engine is dormant and explicitly out of scope (see CLAUDE.md). Those violations stay as-is until Process Engine is resumed or removed.

Acceptance Criteria

• No raw SQL in routers/git.py — all DB access goes through db/ or a service
• /validate-architecture no longer flags routers/git.py:315 under Invariant Fix: Add missing Docker labels to system agent container #1
• Existing git-sync flow still works (orphan cleanup triggers correctly)

References

• Parent issue: Architecture Validation: 4 critical violations found (2026-04-22) #447 (automated architecture validation, 2026-04-22)
• Invariant Fix: Add missing Docker labels to system agent container #1: @docs/memory/architecture.md#architectural-invariants

[vybe]

Closed by merged PR.