fix(ci): keep workflows on Gitea supply chain

docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1",
-  "generated_at": "2026-06-30T01:35:00+08:00",
+  "generated_at": "2026-07-11T00:32:00+08:00",
   "workplan_id": "P0-004-TEMPLATE-COPY-CONTROLLED-APPLY",
   "source_template_path": "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml",
   "destination_workflow_path": ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
-  "source_template_content_sha256_12": "980ff5452f59",
-  "destination_workflow_content_sha256_12": "980ff5452f59",
+  "source_template_content_sha256_12": "6a6710f37fd1",
+  "destination_workflow_content_sha256_12": "6a6710f37fd1",
   "template_copy_recorded": true,
   "destination_workflow_runtime_visible_required": false,
   "runtime_image_excludes_dot_gitea": true,

docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml

@@ -30,7 +30,16 @@ jobs:
     runs-on: awoooi-non110-host
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout source from Gitea
+        env:
+          GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "$GITEA_SOURCE_URL"
+          git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA"
+          git checkout --force --detach FETCH_HEAD
 
       - name: Validate warning-step boundaries
         run: |