fix: inject core.protectNTFS via GIT_CONFIG env vars

Cookiecutter internally runs git clone, which also fails on NTFS due
to the template directory name containing quote characters. Use
GIT_CONFIG_COUNT/KEY/VALUE environment variables to inject
core.protectNTFS=false into all git invocations without needing a
config file or HOME directory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JonZeolla

.github/workflows/ci.yml

@@ -125,14 +125,18 @@ jobs:
           SKIP_GIT_PUSH: 'true'
           TEMPLATE_BRANCH: ${{ github.head_ref || github.ref_name }}
           TEMPLATE_REPO: ${{ github.repository }}
+          # The template directory name contains quotes which are illegal on NTFS.
+          # GIT_CONFIG_COUNT/KEY/VALUE injects core.protectNTFS=false into every
+          # git invocation (including cookiecutter's internal git clone) without
+          # needing a config file.
+          GIT_CONFIG_COUNT: '1'
+          GIT_CONFIG_KEY_0: core.protectNTFS
+          GIT_CONFIG_VALUE_0: 'false'
         run: |
-          # Configure git identity for the post-gen commit
           git config --global user.name "CI Automation"
           git config --global user.email "ci@zenable.io"
 
           # Cookiecutter fetches the template from the remote branch.
-          # This avoids checking out the repo locally, which is impossible on
-          # Windows due to illegal NTFS characters in the template directory name.
           uvx --with gitpython cookiecutter "gh:$env:TEMPLATE_REPO" --checkout "$env:TEMPLATE_BRANCH" --no-input --output-dir "$env:RUNNER_TEMP"
       - name: Verify generated project
         shell: pwsh