repo import --from resolves and checks the address and runs git pinned to it (internal/gitpin, shared with mirror sync); git://, credentials, queries and fragments in the URL are refused; numeric-looking hosts refused; wildcard pin; git's environment replaced. Wiki, e2e, CHANGELOG with upgrade note. import-issues remains #301.
Stacked on !511.
Closes #298