Although I don't plan to build this out any more than necessary, I'll probably eventually just expose this log (except for IP addresses) to anyone who can see the repository. This feels a little more open than strictly necessary (e.g., it would let me see when you've cloned the repo), but I think it's not really problematic to expose, and justified by the difficulty many users have configuring repository hosting (since we'll be able to give them more information about what went wrong).

We also already have similar rules for the push log. I do think there's a material difference between showing when you edited something (which we always do in all other applications) and when you merely looked at it, but exposing clone activity doesn't feel creepy/weird to me in the same way that read receipts or "who is looking at this page right now" sort of do (maybe because it's almost never socially interesting).