ci: replace actions/checkout with plain git on self-hosted runners

Runners on this network intermittently time out downloading the action
tarball from codeload.github.com (HttpClient 100s limit, 3 attempts, job
dead before the first step). git fetch talks to github.com directly and
needs no action download at all.

- detect-changes: fetch --depth 2 (keeps the HEAD~1 diff working)
- deploy: fetch --depth 1
- token passed via env for the fetch, then scrubbed from .git/config so it
  doesn't persist in the runner workspace; git clean keeps checkout@v4's
  clean-workspace behaviour

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -17,10 +17,23 @@ jobs:
     outputs:
       matrix: ${{ steps.filter.outputs.matrix }}
     steps:
-      - name: Checkout
+      # Plain git instead of actions/checkout: self-hosted runners on this
-        uses: actions/checkout@v4
+      # network intermittently time out downloading action tarballs from
-        with:
+      # codeload.github.com (100s HttpClient limit x3 = dead job). git fetch
-          fetch-depth: 2
+      # talks to github.com directly and needs no action download at all.
+      - name: Checkout (plain git, depth 2)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
+          git fetch -q --depth 2 origin "${{ github.sha }}"
+          git checkout -q --force "${{ github.sha }}"
+          git clean -ffdq
+          # Don't leave the token in .git/config on the persistent runner workspace.
+          git remote set-url origin "https://github.com/${{ github.repository }}.git"
 
       - name: Determine changed services
         id: filter
@@ -103,8 +116,20 @@ jobs:
       COMPOSE_DOCKER_CLI_BUILD: "1"
 
     steps:
-      - name: Checkout
+      # Same rationale as detect-changes: no action download on this network.
-        uses: actions/checkout@v4
+      - name: Checkout (plain git)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
+          git fetch -q --depth 1 origin "${{ github.sha }}"
+          git checkout -q --force "${{ github.sha }}"
+          git clean -ffdq
+          # Don't leave the token in .git/config on the persistent runner workspace.
+          git remote set-url origin "https://github.com/${{ github.repository }}.git"
 
       - name: Resolve project and build env file
         run: |