ci: replace second actions/checkout with raw git clone for engram-lang

act_runner v0.6 host-mode hits a 'permission denied' error on
.git/objects/pack/*.idx when running two checkout steps in the same
job. Drop down to a plain git clone of engram-lang and pin EL_HOME
outside the workspace.

.gitea/workflows/deploy.yaml

@@ -34,33 +34,24 @@ jobs:
           fetch-depth: 1
 
       # foundation/el contains the elc compiler that build-stage.sh shells out
-      # to. Cloning it as a sibling matches the local-dev layout the script
+      # to. We clone engram-lang directly with git rather than a second
-      # already expects: ${LANDING_DIR}/../../foundation/el.
+      # actions/checkout call — act_runner v0.6 in host mode hits a
-      - name: Checkout engram-lang (foundation/el — provides the elc compiler)
+      # `permission denied` error on .git/objects/pack/*.idx when running
-        uses: actions/checkout@v4
+      # two checkout steps in the same job. EL_HOME is pinned outside the
-        with:
+      # workspace so the path build-stage.sh expects (../../foundation/el)
-          repository: neuron-technologies/engram-lang
+      # resolves correctly.
-          path: engram-lang
+      - name: Clone engram-lang (foundation/el — provides the elc compiler)
-          fetch-depth: 1
+        env:
-          # Gitea-issued GITHUB_TOKEN is workflow-scoped to the current repo
+          CHECKOUT_TOKEN: ${{ secrets.CHECKOUT_TOKEN }}
-          # only. Cross-repo checkout needs a token with read access to
-          # neuron-technologies/engram-lang. CHECKOUT_TOKEN holds Will's
-          # admin API token (sourced from ~/Secrets/api-keys/gitea-api-token).
-          # Long-term: provision a dedicated read-only PAT.
-          token: ${{ secrets.CHECKOUT_TOKEN }}
-
-      - name: Stage engram-lang as foundation/el for build-stage.sh
         run: |
           set -euo pipefail
-          # build-stage.sh resolves EL_HOME to ${pwd}/../../foundation/el by
+          DEST="${{ github.workspace }}/../foundation-el"
-          # default. We override EL_HOME to point inside the workspace so
+          rm -rf "$DEST"
-          # actions/checkout's same-workspace constraint is respected.
+          git clone --depth 1 \
-          mv engram-lang ../foundation-el
+            "https://will:${CHECKOUT_TOKEN}@git.neuralplatform.ai/neuron-technologies/engram-lang.git" \
-          ls -la ../foundation-el | head -5
+            "$DEST"
-
+          ls -la "$DEST" | head -5
-      - name: Set EL_HOME for build-stage.sh
+          echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
-        run: |
-          echo "EL_HOME=${{ github.workspace }}/../foundation-el" >> "$GITHUB_ENV"
 
       - name: Authenticate to GCP (Workload Identity)
         id: auth