fix: replace actions/checkout with git clone in container jobs

The alpine and gitleaks container images lack Node.js, which
actions/checkout@v4 requires. Use manual git clone instead.
Build job stays on host where actions/checkout works natively.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -12,7 +12,11 @@ jobs:
     container:
       image: python:3.12-alpine
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Install ruff
         run: pip install --no-cache-dir -q ruff
       - name: Lint
@@ -24,7 +28,11 @@ jobs:
     container:
       image: python:3.12-alpine
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Install deps
         run: |
           pip install --no-cache-dir -q -r requirements.txt
@@ -38,9 +46,10 @@ jobs:
       image: ghcr.io/gitleaks/gitleaks:latest
       options: --entrypoint ""
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Checkout
+        run: |
+          git clone --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Scan for secrets
         run: gitleaks detect --source . -v