Fix repository cloning when running inside a container

Use DataDir/builds instead of /tmp for clone directories so that bind
mounts work correctly when upaas itself runs in a Docker container.
The /tmp directory inside the upaas container isn't accessible to the
Docker daemon on the host, causing bind mount failures.

Also fix test setups to pass Config to deploy service and add delay
to webhook test to avoid temp directory cleanup race with async
deployment goroutine.

internal/service/deploy/deploy.go

@@ -26,6 +26,8 @@ const (
 	healthCheckDelaySeconds = 60
 	// upaasLabelCount is the number of upaas-specific labels added to containers.
 	upaasLabelCount = 1
+	// buildsDirPermissions is the permission mode for the builds directory.
+	buildsDirPermissions = 0o750
 )
 
 // Sentinel errors for deployment failures.
@@ -202,7 +204,18 @@ func (svc *Service) cloneRepository(
 	app *models.App,
 	deployment *models.Deployment,
 ) (string, func(), error) {
-	tempDir, err := os.MkdirTemp("", "upaas-"+app.ID+"-*")
+	// Use a subdirectory of DataDir for builds since it's mounted from the host
+	// and accessible to Docker for bind mounts (unlike /tmp inside the container)
+	buildsDir := filepath.Join(svc.config.DataDir, "builds")
+
+	err := os.MkdirAll(buildsDir, buildsDirPermissions)
+	if err != nil {
+		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create builds dir: %w", err))
+
+		return "", nil, fmt.Errorf("failed to create builds dir: %w", err)
+	}
+
+	tempDir, err := os.MkdirTemp(buildsDir, app.ID+"-*")
 	if err != nil {
 		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create temp dir: %w", err))