Fix CI: vendor-fetch commit fails with no git identity configured

scripts/setup.sh's fetch_pinned() creates a fresh git repo per vendored
dependency and commits it with --author set, but --author alone doesn't
satisfy git's separate committer-identity requirement - it works on a
dev machine with ~/.gitconfig already set, but fails outright in a
clean CI container with no git identity anywhere (confirmed: Gitea
Actions failed at exactly this step with "Committer identity unknown").
Fixed by scoping user.name/user.email via -c flags to just this commit
invocation, verified to succeed even with HOME pointed at an empty
directory and no inherited git env vars.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/setup.sh

@@ -52,7 +52,12 @@ fetch_pinned() {
    rm -f "/tmp/${name}-${sha}.tar.gz"
    git -C "$dest" init -q
    git -C "$dest" add -A
-   git -C "$dest" commit -q -m "vendor: $name @ $sha" --author="vpinball-wasm setup <noreply@localhost>"
+   # -c user.name/user.email (not --author) are needed here: --author only sets
+   # the commit's author field, but git also requires a *committer* identity,
+   # which a fresh CI container has no ~/.gitconfig to supply. Scoped to this
+   # one invocation only - doesn't touch any persistent git config.
+   git -C "$dest" -c user.name="vpinball-wasm setup" -c user.email="noreply@localhost" \
+      commit -q -m "vendor: $name @ $sha" --author="vpinball-wasm setup <noreply@localhost>"
    echo "$sha" > "$sentinel"
 }