ci: authenticate tramiton fetch via extraheader (actions/checkout form)

The placeholder-username URL form returned "Repository not found". Switch to the
canonical http.extraheader Basic-auth used by actions/checkout
(x-access-token:<token>) to remove the username variable. Definitive test of
whether the Collaborative Owner grant covers a cargo git-dep clone.

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -50,17 +50,19 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + the ephemeral Actions
+      # this Gitea instance). Rewrite its SSH URL to HTTPS and authenticate with
-      # token so the runner can fetch it — no PAT needed. This works because
+      # the ephemeral Actions token using the same Basic-auth extraheader form
-      # sharang/tramiton lists sharang as a Collaborative Owner (tramiton →
+      # that actions/checkout uses (username `x-access-token`) — no PAT needed,
-      # Settings → Actions), which lets this repo's Actions read tramiton.
+      # provided sharang/tramiton grants this repo access via Collaborative Owners
+      # (tramiton → Settings → Actions).
       - name: Configure git auth for private tramiton dependency
-        run: |
-          git config --global \
-            url."https://gitea-actions:${{ github.token }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@gitea.meghsakha.com:22222/"
         env:
+          GITEA_ACTIONS_TOKEN: ${{ github.token }}
           RUSTC_WRAPPER: ""
+        run: |
+          AUTH=$(printf 'x-access-token:%s' "$GITEA_ACTIONS_TOKEN" | base64 -w0)
+          git config --global http."https://gitea.meghsakha.com/".extraheader "Authorization: Basic $AUTH"
+          git config --global url."https://gitea.meghsakha.com/".insteadOf "ssh://git@gitea.meghsakha.com:22222/"
 
       # Format (no compilation needed)
       - name: Format