ci: use ephemeral pro submodule auth [Story PRO-13.5]

Author: rafaelscosta

.github/workflows/pro-integration.yml

@@ -88,11 +88,9 @@ jobs:
           PRO_SUBMODULE_TOKEN: ${{ secrets.PRO_SUBMODULE_TOKEN }}
         run: |
           echo "::add-mask::$PRO_SUBMODULE_TOKEN"
-          cleanup_pro_submodule_token() {
-            git config --local --unset-all url."https://x-access-token:${PRO_SUBMODULE_TOKEN}@github.com/SynkraAI/".insteadOf || true
-          }
-          trap cleanup_pro_submodule_token EXIT
-          git config --local url."https://x-access-token:${PRO_SUBMODULE_TOKEN}@github.com/SynkraAI/".insteadOf "https://github.com/SynkraAI/"
+          export GIT_CONFIG_COUNT=1
+          export GIT_CONFIG_KEY_0="url.https://x-access-token:${PRO_SUBMODULE_TOKEN}@github.com/SynkraAI/.insteadOf"
+          export GIT_CONFIG_VALUE_0="https://github.com/SynkraAI/"
           git submodule sync --recursive
           git submodule update --init --recursive
 

docs/stories/epic-pro-13/STORY-PRO-13.5-PRIVATE-PRO-DISTRIBUTION-HARDENING.md

@@ -466,7 +466,7 @@ Expected implementation touchpoints:
 - 2026-05-12: Student install incident triage confirmed the unscoped `npx aiox-pro recover/install/setup` path is invalid for fresh machines; installer and docs now point recovery to `npx -y @aiox-squads/aiox-pro-cli@latest recover` and setup to `npx -y -p @aiox-squads/core@latest aiox pro setup`.
 - 2026-05-12: `@aiox-squads/installer` bumped to `3.3.2` and `@aiox-squads/aiox-pro-cli` bumped to `0.2.1` so @devops can publish the signed-artifact installer and scoped CLI command fix.
 - 2026-05-12: GitHub Pro Integration checkout fixed to use `GITHUB_TOKEN` for the `aiox-core` PR merge ref and reserve `PRO_SUBMODULE_TOKEN` for private Pro submodule initialization only.
-- 2026-05-12: CodeRabbit PR follow-up applied: Pro Integration now stores the credentialized submodule URL in repo-local git config with `trap` cleanup, and Pro wizard tests use repository-absolute package imports.
+- 2026-05-12: CodeRabbit PR follow-up applied: Pro Integration now injects the credentialized submodule URL through process-scoped `GIT_CONFIG_*` environment variables, and Pro wizard tests use repository-absolute package imports.
 - Validation evidence:
   - `node -c packages/installer/src/wizard/pro-setup.js && node -c packages/aiox-pro-cli/bin/aiox-pro.js && node -c bin/utils/validate-publish.js`
   - `node -c packages/installer/src/pro/pro-scaffolder.js && node -c pro/license/license-api.js && node -c .aiox-core/cli/commands/pro/index.js`