Why: the realcombo steps unset the URL-scoped token env before 'submodule update', so nested pins fell back to raw SSH URLs and failed host-key verification on the runner (first svc-realcombo run 2605). Evidence: job log run 2605 shows ssh clone failures; reordered steps keep insteadOf + token header active through the pins fetch. Impact: ci.yaml ordering only.