fix(submodule): check transport policy before replacing a remote

`RootModule.update` fetches a temporary remote when `.gitmodules` changes a
submodule URL. That fetch still treated the URL as user-provided, even after
ordinary submodule clone/fetch gained Git's non-user transport environment.
It could therefore access a denied local repository and replace `origin`
before the subsequent ordinary fetch finally rejected the transport.

Port PR #2304's separate changed-URL regression and apply the existing
`_transport_env()` helper to that initial fetch. The test compares denial
with real `git submodule sync` / `update --remote`, and checks unchanged
HEAD and original-remote preservation against a rejected Git fetch. Its
location-dependent initial repositories use the shared scripted fixtures.

Both source regressions failed on the original CLI and Gix backends. The
changed-URL test also failed independently after the ordinary update fix,
because `origin` had already changed. After this fix, 17 focused transport,
root-update, and no-fetch cases pass on each backend under the isolated
runner, using Git 2.54.0 and GixPython 0.2.0. Ruff lint/format, shellcheck,
and `git diff --check` pass. The fetch remains an explicit CLI operation.

Author: codex

git/objects/submodule/root.py

@@ -306,7 +306,8 @@ def update(  # type: ignore[override]
                                 else:
                                     assert nn not in [r.name for r in rmts]
                                     smr = smm.create_remote(nn, sm_url)
-                                    smr.fetch(progress=progress)
+                                    with smm.git.custom_environment(**sm._transport_env()):
+                                        smr.fetch(progress=progress)
 
                                     # If we have a tracking branch, it should be available
                                     # in the new remote as well.

test/test_submodule.py

@@ -165,6 +165,34 @@ def test_update_applies_git_transport_policy_to_gitmodules_url(monkeypatch):
                 assert module.head.commit.hexsha == baseline_module.git.rev_parse("HEAD") == source.head.commit.hexsha
 
 
+@patch_git_config("protocol.file.allow", "user")
+def test_root_update_applies_git_transport_policy_to_changed_url(monkeypatch):
+    monkeypatch.setenv("GIT_PROTOCOL_FROM_USER", "1")
+    # The submodule URLs point to this private source and replacement.
+    with writable_fixture("submodule-transport.sh", "changed-url", execute=True) as fixture:
+        root = fixture.path().resolve()
+        with git.Repo(root / "source") as source, git.Repo(root / "parent") as parent, git.Repo(
+            root / "baseline"
+        ) as baseline, git.Repo(root / "baseline" / "module") as baseline_module:
+            submodule = parent.submodules[0]
+            previous = (root / "previous").read_text().strip()
+            # A rejected fetch preserves the original remote and checked-out commit.
+            with baseline_module.git.custom_environment(GIT_PROTOCOL_FROM_USER="0"):
+                with pytest.raises(GitCommandError, match="transport 'file' not allowed"):
+                    baseline_module.git.fetch(str(root / "replacement"))
+            assert Path(baseline_module.remotes.origin.url).samefile(source.working_tree_dir)
+            assert baseline_module.git.rev_parse("HEAD") == source.head.commit.hexsha
+            baseline.git.submodule("sync")
+            with pytest.raises(GitCommandError, match="transport 'file' not allowed"):
+                baseline.git.submodule("update", "--remote")
+
+            with pytest.raises(GitCommandError, match="transport 'file' not allowed"):
+                RootModule(parent).update(previous_commit=previous)
+            with submodule.module() as module:
+                assert Path(module.remotes.origin.url).samefile(source.working_tree_dir)
+                assert module.head.commit.hexsha == baseline_module.git.rev_parse("HEAD") == source.head.commit.hexsha
+
+
 @pytest.mark.parametrize(
     "scenario,name",
     [

tests/fixtures/submodule-transport.sh

@@ -6,5 +6,16 @@ git -C source commit --allow-empty -qm initial
 git init -q -b master parent
 git -C parent -c protocol.file.allow=always submodule add "$root/source" module
 git -C parent commit -qm 'Add submodule'
-git clone -q parent clone
-git clone -q parent baseline
+if test "$1" = update; then
+    git clone -q parent clone
+    git clone -q parent baseline
+else
+    git clone -q source replacement
+    git -C parent rev-parse HEAD >previous
+    git -C parent config -f .gitmodules submodule.module.url "$root/replacement"
+    git -C parent add .gitmodules
+    git -C parent commit -qm 'Replace submodule URL'
+    git clone -q parent baseline
+    git -C baseline -c protocol.file.allow=always submodule update --init
+    git -C baseline/module remote set-url origin "$root/source"
+fi