fix: vendor cloning, Makefile shell-logic, config TLS fields, AGENTS.md

ober

ac6171881a5ec78e4ee5bf725c361b41a0fd42c4

diff --git a/.gitignore b/.gitignore
index bb8f7d6..599f294 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 build/
 dist/
 var/
+vendor/
 *.so
 *.wpo
 vendor/ 
diff --git a/AGENTS.md b/AGENTS.md
index 0dec250..d72c236 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -370,18 +370,16 @@ improved versions of the above.
 
 When working in a Jerboa project, **ONLY modify files in the current repo** unless the user explicitly names another path.
 
-### Release Distribution: SourceHut Only
-
-**Never use GitHub Releases, GitHub release URLs, or GitHub as a fallback for
-Jerboa release artifacts.** Jerboa's sole official release channel is attached
-files on a versioned SourceHut git tag. Publish them with
-`hut git -r ~lisp/jerboa artifact upload <file> --rev <tag>` (normally through
-`make release-upload`) and download them from
-`https://git.sr.ht/~lisp/jerboa/refs/download/<tag>/<artifact>`.
-
-Do not add a GitHub mirror or fallback when SourceHut delivery needs work;
-repair or configure the SourceHut release path instead. See the SourceHut
-manual: <https://man.sr.ht/git.sr.ht/#attaching-files-to-releases>.
+### Release Distribution: git.jerboa.sh Only
+
+**Never use SourceHut or GitHub Releases, release URLs, mirrors, or fallbacks
+for Jerboa artifacts.** The canonical human-facing repository URL is
+`https://git.jerboa.sh/ober/jerboa`. Publish release files on the matching
+versioned release at `git.jerboa.sh`; consumers download them from
+`https://git.jerboa.sh/ober/jerboa/releases/download/<tag>/<artifact>`.
+
+If delivery needs work, repair or configure the `git.jerboa.sh` release path.
+Do not reintroduce SourceHut or add a GitHub mirror.
 
 Common sibling repos that exist but must NOT be touched without explicit instruction:
 - `~/mine/jerboa-mcp` — Legacy node MCP, superseded. The active MCP server now lives in THIS repo at `mcp/` + `data/`. Don't modify the legacy repo unless told.
diff --git a/Makefile b/Makefile
index d0dd918..56e342a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 JERBUILD ?= jerboa jerbuild
 JERBOA_HOME ?= $(shell $(JERBUILD) --jerboa-home 2>/dev/null)
 ifeq ($(JERBOA_HOME),)
-JERBOA_HOME := $(HOME)/mine/jerboa
+$(error jerboa not found — install Jerboa or set JERBOA_HOME)
 endif
 
 # Vendored dependencies
@@ -20,9 +20,20 @@ PORT ?= 8080
 
 BINARY_OUTPUT ?= dist/gitsite
 
-.PHONY: build run run-builds check clean binary jerboa-git
+.PHONY: build run run-builds check clean binary jerboa-git vendor vendor-jsqlite vendor-sinatra
 
-build: jerboa-git
+vendor: vendor-jsqlite vendor-sinatra vendor-git
+
+vendor-jsqlite:
+	if [ ! -d vendor/jsqlite/jsqlite ]; then git clone --depth 1 ssh://git@git.jerboa.sh:2222/ober/jerboa-sqlite.git vendor/jsqlite-tmp && cp -r vendor/jsqlite-tmp/src/jsqlite vendor/jsqlite && rm -rf vendor/jsqlite-tmp; fi
+
+vendor-sinatra:
+	if [ ! -d vendor/jerboa-sinatra/sinatra ]; then git clone --depth 1 ssh://git@git.jerboa.sh:2222/ober/jerboa-sinatra.git vendor/jerboa-sinatra-tmp && cp -r vendor/jerboa-sinatra-tmp/sinatra vendor/jerboa-sinatra/ && cp vendor/jerboa-sinatra-tmp/sinatra.ss vendor/jerboa-sinatra/ && rm -rf vendor/jerboa-sinatra-tmp; fi
+
+vendor-git:
+	if [ ! -f vendor/jerboa-git/native/Cargo.toml ]; then rm -rf vendor/jerboa-git/native; mkdir -p vendor/jerboa-git; git clone --depth 1 ssh://git@git.jerboa.sh:2222/ober/jerboa-git.git vendor/jerboa-git-tmp && cp -r vendor/jerboa-git-tmp/native vendor/jerboa-git/native && rm -rf vendor/jerboa-git-tmp; fi
+
+build: vendor jerboa-git
 	rm -rf $(SRC_STAGE) $(LIB_STAGE)
 	mkdir -p $(SRC_STAGE)/gitsite $(SRC_STAGE)/sinatra $(LIB_STAGE)
 	cp src/gitsite/*.ss $(SRC_STAGE)/gitsite/
diff --git a/etc/gitsite.sexp b/etc/gitsite.sexp
index d114c99..d2a5a17 100644
--- a/etc/gitsite.sexp
+++ b/etc/gitsite.sexp
@@ -3,4 +3,6 @@
  (var-root "var")
  (public-url "http://localhost:8080")
  (registration "open")
- (session-secret "change-this-to-a-random-secret-in-production"))
+ (session-secret "change-this-to-a-random-secret-in-production")
+ (tls-cert #f)
+ (tls-key #f))