ci: switch runner git clones from HTTPS+CF Access to SSH deploy key

servers/legion/k8s/gitea-runner/Dockerfile

@@ -96,17 +96,9 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
 # build containers with its own entrypoint to keep them alive between
 # steps, and overriding it breaks job execution.
 
-# In-cluster git redirect — GKE runners resolve the internal Gitea service
-# directly, bypassing Cloudflare Access. This insteadOf rule rewrites any
-# clone/fetch of the public URL to the in-cluster service URL so CI jobs work
-# without CF Access headers inside the GKE cluster.
-#
-# On Legion runners this is overridden at runtime by git-cf-access-init.sh
-# (which sets the reverse redirect + CF Access headers). The system-level rule
-# here is a safe baseline; the init script wins because it runs after.
-RUN git config --system \
-    url."http://gitea.gitea.svc.cluster.local:3000/".insteadOf \
-    "https://git.neuralplatform.ai/"
-
-COPY git-cf-access-init.sh /usr/local/bin/git-cf-access-init.sh
-RUN chmod +x /usr/local/bin/git-cf-access-init.sh
+# SSH-based git clone init script.
+# Sourced before every CI step via BASH_ENV (set in deployment.yaml).
+# Writes GITEA_SSH_PRIVATE_KEY to ~/.ssh/gitea_key and rewrites HTTPS
+# Gitea URLs to SSH so actions/checkout and git clone both use SSH auth.
+COPY git-ssh-init.sh /usr/local/bin/git-ssh-init.sh
+RUN chmod +x /usr/local/bin/git-ssh-init.sh