scripts/setup.sh's fetch_pinned() creates a fresh git repo per vendored dependency and commits it with --author set, but --author alone doesn't satisfy git's separate committer-identity requirement - it works on a dev machine with ~/.gitconfig already set, but fails outright in a clean CI container with no git identity anywhere (confirmed: Gitea Actions failed at exactly this step with "Committer identity unknown"). Fixed by scoping user.name/user.email via -c flags to just this commit invocation, verified to succeed even with HOME pointed at an empty directory and no inherited git env vars. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>