test(e2e): workflow example 18 — container with remote repo clone (trusted profile)

E2E test for Specification Workflow Example 18: Container with Remote
Repo Clone using the trusted automation profile.  Exercises the full
container-instance workflow per the spec:

- Registers a container-instance resource with --clone-into flag (new
  CLI flag added to resource add for REPO_URL:CONTAINER_PATH).
- Two-step project creation: project create + project link-resource.
- Dynamic LLM actor selection (Anthropic/OpenAI) matching available
  API keys.
- Plan use with --execution-environment container,
  --execution-env-priority fallback, and --automation-profile trusted.
- Full plan lifecycle: strategize, execute, diff, apply, status.
- Positive assertions: non-empty output, plan ID presence, terminal
  state verification, container/clone evidence logging.
- Negative assertions: Traceback and INTERNAL error checks.
- ULID regex uses Crockford base32 character set.
- Unique suffix for resource/project names (parallel CI safe).
- Skip If No LLM Keys guard for graceful degradation.
- CHANGELOG.md updated.

ISSUES CLOSED: #764

features/resource_cli_coverage.feature

@@ -215,3 +215,29 @@ Feature: Resource CLI error path coverage
     When I run resource type add with path to missing file
     Then the resource command should fail
     And the resource output should contain "not found"
+
+  # ---- --clone-into flag coverage ----
+
+  Scenario: resource add container-instance with --clone-into stores clone_into property
+    Given built-in types are bootstrapped
+    When I run resource add "container-instance" "local/clone-test" with clone-into "https://github.com/acme/api.git:/workspace"
+    Then the resource output should contain "local/clone-test"
+    And the resource output should contain "Added resource"
+
+  Scenario: resource add with --clone-into on non-container type fails
+    Given built-in types are bootstrapped
+    When I run resource add "git-checkout" "local/bad-clone" with clone-into "https://github.com/acme/api.git:/workspace"
+    Then the resource command should fail
+    And the resource output should contain "Validation error"
+
+  Scenario: resource add with --clone-into in invalid format fails
+    Given built-in types are bootstrapped
+    When I run resource add "container-instance" "local/bad-fmt" with clone-into "no-colon-separator"
+    Then the resource command should fail
+    And the resource output should contain "Validation error"
+
+  Scenario: resource add with --clone-into missing path segment fails
+    Given built-in types are bootstrapped
+    When I run resource add "container-instance" "local/bad-path" with clone-into "https://github.com/acme/api.git:"
+    Then the resource command should fail
+    And the resource output should contain "Validation error"