git fetch over HTTPS is broken on this Gitea instance since 2026-08-12:
`git upload-pack --stateless-rpc` aborts with
BUG("packfile_uris requires sideband-all") in upload-pack.c and dumps
core on every fetch. Every checkout therefore failed before the scan
started, which is why all security runs have been red since then.
Reproduced against every repo, from multiple clients, on git 2.52 and
2.55, and on Gitea 1.26.1 as well as 1.26.4. SSH, the web UI and the
API are unaffected — only the smart-HTTP pack transfer dies.
Semgrep and Trivy operate on the working tree and do not need history,
so the sources are pulled as a tar archive over plain HTTP. This sidesteps
upload-pack entirely. Revert to actions/checkout once the fetch path is
fixed upstream.
