Why: on keyless runners the RDM cache clone and pins materialization inside svc.sh fetched nested pins over raw SSH URLs (run 2608: host key verification failed); the suite now injects the same URL-scoped token header and insteadOf rewrite via environment when SVC_CI_GIT_* is set. Evidence: local rerun stays green (env unset locally); CI run applies it. Impact: tests + ci.yaml only; token travels via environment only.