🐛 fix(ci): isolate gitea workflow repos

use a fresh per-job checkout directory for test, standards, and
thirdparty update workflows instead of reusing a shared repo path.

align the Gitea standards-check template with the same isolation
strategy and expand workflow bootstrap regression coverage.

templates/ci/gitea/.gitea/workflows/standards-check.yml

@@ -29,46 +29,32 @@ jobs:
           echo "========================================"
 
           REPO_NAME="${{ github.event.repository.name }}"
-          REPO_DIR="${{ env.WORKSPACE_DIR }}/$REPO_NAME"
           TOKEN="${{ secrets.WORKFLOW }}"
+          mkdir -p "${{ env.WORKSPACE_DIR }}"
+          REPO_DIR="$(mktemp -d "${{ env.WORKSPACE_DIR }}/${REPO_NAME}.XXXXXX")"
           if [ -n "$TOKEN" ]; then
             REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${{ github.repository }}.git"
           else
             REPO_URL="${GITHUB_SERVER_URL}/${{ github.repository }}.git"
           fi
 
-          if [ -d "$REPO_DIR" ]; then
-            if [ -d "$REPO_DIR/.git" ]; then
-              cd "$REPO_DIR"
-              git clean -fdx
-              git reset --hard
-              git fetch --all --tags --force --prune --prune-tags
-            else
-              rm -rf "$REPO_DIR"
-            fi
-          fi
-
-          if [ ! -d "$REPO_DIR/.git" ]; then
-            mkdir -p "${{ env.WORKSPACE_DIR }}"
-            git clone "$REPO_URL" "$REPO_DIR"
-            cd "$REPO_DIR"
-          fi
+          git clone "$REPO_URL" "$REPO_DIR"
 
           TARGET_SHA="${{ github.sha }}"
           TARGET_REF="${{ github.ref }}"
-          if git cat-file -e "$TARGET_SHA^{commit}" 2>/dev/null; then
-            git checkout -f "$TARGET_SHA"
+          if git -C "$REPO_DIR" cat-file -e "$TARGET_SHA^{commit}" 2>/dev/null; then
+            git -C "$REPO_DIR" checkout -f "$TARGET_SHA"
           else
             if [ -n "$TARGET_REF" ]; then
-              git fetch origin "$TARGET_REF"
-              git checkout -f FETCH_HEAD
+              git -C "$REPO_DIR" fetch origin "$TARGET_REF"
+              git -C "$REPO_DIR" checkout -f FETCH_HEAD
             else
-              git checkout -f "${{ github.ref_name }}"
+              git -C "$REPO_DIR" checkout -f "${{ github.ref_name }}"
             fi
           fi
 
           git config --global --add safe.directory "$REPO_DIR"
-          echo "REPO_DIR=$REPO_DIR" >> $GITHUB_ENV
+          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
       - name: 🧪 Lint commit message / PR title
         run: |
           cd "$REPO_DIR"