fix: replace all actions/checkout with git clone

The linux runner (anvil) has no Node.js, so actions/checkout@v4
fails on every job. Use manual git clone consistently across
all jobs — container and host alike.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -43,9 +43,8 @@ jobs:
   secrets:
     runs-on: linux
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Checkout
+        run: git clone --branch "${GITHUB_REF_NAME}" "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Scan for secrets
         run: |
           podman run --rm \
@@ -58,7 +57,8 @@ jobs:
     needs: [test, secrets]
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        run: git clone --depth 1 --branch "${GITHUB_REF_NAME}" "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
       - name: Login to Harbor
         run: echo "$HARBOR_PASS" | podman login -u "$HARBOR_USER" --password-stdin harbor.mymx.me
         env: