fix(ci): clear stale checkout metadata from Git common dir

[ael-dev3]

Problem

The persistent Linux runner can retain info/grafts and related Git metadata in the checkout's common directory. The production cleanup only inspected .git/..., so G001 materialization still failed with Git graft warnings and the bounded g001-materialization diagnostic.

Change

• Resolve the exact checkout Git directory and common directory with a sanitized pinned Git invocation.
• Validate both paths remain under the exact production workspace and retain owner, mode, realpath, and non-symlink checks.
• Remove stale config.worktree, grafts, attributes, alternates, and shallow metadata from both locations in every protected production lane.
• Keep the existing local user identity cleanup.

Validation

• tests/sealedRealmsProductionWorkflow.test.ts targeted run: 14 passed, 38 skipped on Windows.
• Workflow YAML parsed successfully.
• git diff --check passed.
• Gitleaks range scan passed with no leaks.

This is a release-blocking reliability fix only; it does not add gameplay features or change provider behavior.