🐛 fix(ci): isolate gitea workflow repos

use a fresh per-job checkout directory for test, standards, and
thirdparty update workflows instead of reusing a shared repo path.

align the Gitea standards-check template with the same isolation
strategy and expand workflow bootstrap regression coverage.

.gitea/workflows/update-thirdparty-skills.yml

@@ -33,36 +33,19 @@ jobs:
           echo "========================================"
 
           REPO_NAME="${{ github.event.repository.name }}"
-          REPO_DIR="${{ env.WORKSPACE_DIR }}/$REPO_NAME"
           TOKEN="${{ secrets.WORKFLOW }}"
+          mkdir -p "${{ env.WORKSPACE_DIR }}"
+          REPO_DIR="$(mktemp -d "${{ env.WORKSPACE_DIR }}/${REPO_NAME}.XXXXXX")"
           if [ -n "$TOKEN" ]; then
             REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${{ github.repository }}.git"
           else
             REPO_URL="${GITHUB_SERVER_URL}/${{ github.repository }}.git"
           fi
 
-          if [ -d "$REPO_DIR" ]; then
-            if [ -d "$REPO_DIR/.git" ]; then
-              cd "$REPO_DIR"
-              git ls-files -v | awk '/^[a-zS] / {sub(/^[a-zS] /, ""); print}' | while IFS= read -r path; do
-                git update-index --no-assume-unchanged --no-skip-worktree -- "$path"
-              done
-              git clean -fdx
-              git reset --hard
-              git fetch --all --tags --force --prune --prune-tags
-            else
-              rm -rf "$REPO_DIR"
-            fi
-          fi
+          git clone "$REPO_URL" "$REPO_DIR"
 
-          if [ ! -d "$REPO_DIR/.git" ]; then
-            mkdir -p "${{ env.WORKSPACE_DIR }}"
-            git clone "$REPO_URL" "$REPO_DIR"
-            cd "$REPO_DIR"
-          fi
-
-          git fetch origin main
-          git checkout -B main origin/main
+          git -C "$REPO_DIR" fetch origin main
+          git -C "$REPO_DIR" checkout -B main origin/main
 
           git config --global --add safe.directory "$REPO_DIR"
           echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"