Scope submodule URL rewrites to checkout command in Update Plugins workflow

[Copilot]

The Update Plugins matrix job for ui-mapbox was failing after committing changes because git push lost usable GitHub auth context (could not read Username for 'https://github.com'). The failure stemmed from persistent URL rewrite config applied during submodule setup.

• Root cause

  • Submodule fetch step wrote SSH→HTTPS rewrites into local git config (git config --local --add ... insteadOf ...).
  • Those persistent rewrites leaked beyond submodule update and affected later push behavior.

• Change made

  • Replaced persistent local config writes with command-scoped git config on submodule update.
  • Kept both SSH URL forms mapped (git@github.com: and ssh://git@github.com/) while limiting scope to submodule fetch only.

• Why this resolves the job

  • Submodules still resolve over HTTPS when needed.
  • Repository-level push configuration is no longer mutated before git push.

if [ -f .gitmodules ]; then
  git submodule sync --recursive
  git \
    -c url."https://github.com/".insteadOf=git@github.com: \
    -c url."https://github.com/".insteadOf=ssh://git@github.com/ \
    -c protocol.version=2 \
    submodule update --init --force --depth=1 --recursive
fi