🐛 fix(ci): isolate gitea workflow repos

use a fresh per-job checkout directory for test, standards, and
thirdparty update workflows instead of reusing a shared repo path.

align the Gitea standards-check template with the same isolation
strategy and expand workflow bootstrap regression coverage.

.gitea/workflows/standards-check.yml

@@ -31,33 +31,21 @@ jobs:
           echo "========================================"
 
           REPO_NAME="${{ github.event.repository.name }}"
-          REPO_DIR="${WORKSPACE_DIR}/${REPO_NAME}"
           TOKEN="${{ secrets.WORKFLOW }}"
           TARGET_SHA="${{ github.sha }}"
           TARGET_REF="${{ github.ref }}"
           TARGET_REF_NAME="${{ github.ref_name }}"
 
+          mkdir -p "$WORKSPACE_DIR"
+          REPO_DIR="$(mktemp -d "$WORKSPACE_DIR/${REPO_NAME}.XXXXXX")"
+
           if [ -n "$TOKEN" ]; then
             REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
           else
             REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           fi
 
-          if [ -d "$REPO_DIR" ]; then
-            if [ -d "$REPO_DIR/.git" ]; then
-              cd "$REPO_DIR"
-              git clean -fdx
-              git reset --hard
-              git fetch --all --tags --force --prune --prune-tags
-            else
-              rm -rf "$REPO_DIR"
-            fi
-          fi
-
-          if [ ! -d "$REPO_DIR/.git" ]; then
-            mkdir -p "$WORKSPACE_DIR"
-            git clone "$REPO_URL" "$REPO_DIR"
-          fi
+          git clone "$REPO_URL" "$REPO_DIR"
 
           if git -C "$REPO_DIR" cat-file -e "${TARGET_SHA}^{commit}" 2>/dev/null; then
             git -C "$REPO_DIR" checkout -f "$TARGET_SHA"