ci: install git before checkout in the CommandBox smoke container

The commandbox-install-smoke job has failed with exit 127 on every run
since it was added: the ortussolutions/commandbox image ships without
git, so actions/checkout falls back to the REST-API tarball — which
honors .gitattributes export-ignore, and this repo export-ignores
tools/ and cli/. The workspace therefore never contained the build
scripts and templates the job exists to test.

Install git before checkout so it performs a real clone, and assert
post-checkout that tools/build/scripts/prepare-base.sh is present so
any future fallback is named precisely instead of failing as a
missing-file error three steps later.

Signed-off-by: Peter Amiri <petera@pai.com>

Author: Peter Amiri

.github/workflows/commandbox-install-smoke.yml

@@ -80,8 +80,27 @@ jobs:
       # Pin the version the prepare scripts stamp into the artifacts.
       PKG_VERSION: "0.0.0-cismoke"
     steps:
+      # The CommandBox image ships without git, and actions/checkout without git
+      # falls back to the REST-API tarball — which honors .gitattributes
+      # export-ignore, and this repo export-ignores tools/ and cli/. That left
+      # this job's workspace without the very build scripts and templates it
+      # exists to test (prepare-base.sh: No such file or directory, exit 127,
+      # on every run since the job was added). Install git BEFORE checkout so
+      # it performs a real clone.
+      - name: Ensure git is available (checkout must not fall back to the export-ignored tarball)
+        run: |
+          command -v git >/dev/null 2>&1 || {
+            apt-get update -y && apt-get install -y --no-install-recommends git ca-certificates
+          }
+          git --version
+
       - uses: actions/checkout@v5
 
+      - name: Assert the export-ignored paths actually checked out
+        run: |
+          test -f tools/build/scripts/prepare-base.sh || {
+            echo "::error::tools/ missing from workspace — checkout fell back to the export-ignored tarball again"; exit 1; }
+
       # curl + jq are the only host tools the probes need; the CommandBox image
       # is Debian-based but minimal. Install defensively (no-op if present).
       - name: Ensure curl is available