Keep public integration checkout paths literal

[rmcdaniel]

Refs #158.

End Git option parsing before the fixed public repository URL and destination.
Names such as --bare and --mirror now select literal working-tree paths.
The repository allowlist, disabled credential helper, full lowercase SHA
validation and resolved-commit check remain unchanged.

Real local Git regressions fail on the parent: both names produce a bare
source.git rather than the requested directory. The corrected helper passes
all 20 checkout tests, including default-branch and exact-commit clones
into both names, rejected malformed SHAs and existing public-authority checks.
Ruff passes for both changed files. Tests permit only the local file protocol;
they do not access a remote repository.

This addresses a concrete behavior found while reviewing Sonar
pythonsecurity:S8705. No customer impact or remote-execution exploit is
claimed. All ten exact candidate CI jobs pass, including actual HTTP integration.
Sonar's exact PR report passes with zero OPEN/CONFIRMED findings and 0.0% new
duplication. Independent merged-main CI 39017930118 also passes all ten jobs,
and main's official Sonar app passes on ceb0cd79365255f5575dd745145b9af557f9d0b1.
The reviewed tree is unchanged. Issue #158 is closed; no release is needed.
No SDK runtime, version, dependency, release or protocol changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud