Why: After the Gitea migration some repositories still declare the legacy endpoint in .gitmodules while facts F3 names the new one as authoritative. Both endpoints currently resolve and serve git, so CI needs both insteadOf mappings; dropping either one makes that batch of pins fall back to real SSH and the svc-realcombo job fails on host key verification. Evidence: 2026-10-23 measurement from this machine — both endpoints answer git ls-remote with the same HEAD; Agent-System-Dev declares 14 submodule URLs on the legacy endpoint, Agent-System-Backend 10, Agent-System-RDM 8 and Agent-System-KB-Regulations 2 on the new one. Impact: comments only; no GIT_CONFIG key, job structure or credential handling changes. Refs: feature/ecs-deploy-dev8788-and-kb