Scope submodule URL rewrites to commands in Update Plugins workflow

[Copilot]

Update Plugins was failing in update (ui-mapbox) after committing submodule bumps because git push resolved to https://github.com and lacked credentials. The failure came from persistent local url.*.insteadOf rewrites applied during submodule fetch.

• Root cause

  • The workflow wrote SSH→HTTPS rewrites into repo-local git config before submodule operations.
  • Those rewrites persisted and affected later git push in update-submodules.sh.

• Change

  • In .github/workflows/update.yml, replaced persistent git config --local --add url....insteadOf ... with command-scoped git -c url....insteadOf=... on:
    • git submodule sync --recursive
    • git submodule update --init --force --depth=1 --recursive
  • This keeps HTTPS rewriting limited to submodule fetch/sync only, without mutating local git config for subsequent push operations.

• Representative diff pattern

git \
  -c url."https://github.com/".insteadOf=git@github.com: \
  -c url."https://github.com/".insteadOf=ssh://git@github.com/ \
  submodule update --init --force --depth=1 --recursive