ci: bypass runner's git.redclaw.dev -> /slab/projects mirror for cargo

Real failure surfaced from Gitea action logs on gw-01: cargo can't fetch
the claw-brain dep because the runner's global gitconfig has an includeIf
that maps `https://git.redclaw.dev/*` to `/slab/projects/*` whenever git
runs from ~/.cargo/git/. That local mirror doesn't have the rev cm-brain
pins (0ee183acc1600aba01546bd648bf3cae6f42dcc2), so cargo bails with
"revspec not found" during `cargo clippy`.

clawverse is a public repo and the commit is reachable directly. Set
GIT_CONFIG_GLOBAL to a per-job empty file so the includeIf never applies,
and cargo goes straight to the remote. Local dev is untouched. Follow-up
task: keep the /slab/projects mirrors updated so this workaround becomes
belt-and-suspenders instead of load-bearing.

.github/workflows/ci.yml

@@ -27,9 +27,17 @@ jobs:
     # architect natively, not inside a container), so we start a per-run postgres
     # container and reach it via its bridge IP. GITHUB_RUN_ID scopes the name so
     # concurrent jobs on the same runner don't collide.
+    #
+    # GIT_CONFIG_GLOBAL points at a per-job empty file so cargo's git fetches
+    # bypass the runner's includeIf mapping of git.redclaw.dev → /slab/projects
+    # (local mirror lags and misses recently-pinned commits like the clawverse
+    # rev cm-brain depends on). clawverse is public; no auth needed.
     env:
       SQLX_OFFLINE: "true"
+      GIT_CONFIG_GLOBAL: /tmp/ci-empty-gitconfig-${{ github.run_id }}
     steps:
+      - name: Prepare empty gitconfig for cargo fetches
+        run: touch "$GIT_CONFIG_GLOBAL"
       - uses: actions/checkout@v4
       - name: Start postgres sidecar
         run: |