feat(job): wire use-git-clone + submodules; default in-guest clone

The job command previously discarded --use-git-clone and --submodules
(`del`) and always in-guest cloned with submodules off — making both
action inputs dead no-ops (submodule repos silently broken).

- job.py: --use-git-clone/--host-clone and --submodules/--no-submodules
  are real booleans defaulting to ON. Default = in-guest clone with
  submodules. --host-clone clones on the host into a temp dir
  (_host_clone) and transfers a zip; temp dir cleaned in finally.
  clone_submodules now honoured (was hardcoded False).
- action.yml: use-git-clone / submodules default 'true'; forward the
  explicit positive/negative flag so the Python default is overridden
  deterministically.
- self-test.yml: add smoke-{windows,linux}-hostclone jobs covering the
  host-side transport (default jobs already cover in-guest).
- tests: default-transport, host-clone, and --no-submodules coverage.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/python/test_commands_job.py

@@ -218,6 +218,77 @@ def test_job_happy_path_linux(
     assert not any((base_clone).iterdir()) or all(not p.exists() for p in base_clone.iterdir())
 
 
+def test_job_default_transport_in_guest_with_submodules(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, template_vmx: Path
+) -> None:
+    backend = _FakeBackend(running_after=1)
+    calls = _patch_common(monkeypatch, backend)
+    result = CliRunner().invoke(
+        cli,
+        _common_args(
+            template_vmx, clone_base=tmp_path / "v", artifact_base=tmp_path / "a"
+        ),
+    )
+    assert result.exit_code == 0, result.output
+    kw = calls["linux_build"][0]
+    # Default: in-guest clone (clone_url set, no host source) + submodules.
+    assert kw["host_source_dir"] is None
+    assert kw["clone_url"] and "repo.git" in kw["clone_url"]
+    assert kw["clone_submodules"] is True
+
+
+def test_job_host_clone_transport(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, template_vmx: Path
+) -> None:
+    backend = _FakeBackend(running_after=1)
+    calls = _patch_common(monkeypatch, backend)
+    root = tmp_path / "hostclone"
+    src = root / "src"
+    src.mkdir(parents=True)
+
+    def _fake_host_clone(
+        repo_url: str, branch: str, commit: str, submodules: bool
+    ) -> tuple[Path, Path]:
+        assert submodules is True
+        return root, src
+
+    monkeypatch.setattr(job_module, "_host_clone", _fake_host_clone)
+    result = CliRunner().invoke(
+        cli,
+        _common_args(
+            template_vmx,
+            clone_base=tmp_path / "v",
+            artifact_base=tmp_path / "a",
+            extra=["--host-clone"],
+        ),
+    )
+    assert result.exit_code == 0, result.output
+    kw = calls["linux_build"][0]
+    assert kw["host_source_dir"] == str(src)
+    assert kw["clone_url"] is None
+    assert kw["clone_submodules"] is True
+    # Host-side temp clone removed after the build.
+    assert not root.exists()
+
+
+def test_job_no_submodules_flag(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, template_vmx: Path
+) -> None:
+    backend = _FakeBackend(running_after=1)
+    calls = _patch_common(monkeypatch, backend)
+    result = CliRunner().invoke(
+        cli,
+        _common_args(
+            template_vmx,
+            clone_base=tmp_path / "v",
+            artifact_base=tmp_path / "a",
+            extra=["--no-submodules"],
+        ),
+    )
+    assert result.exit_code == 0, result.output
+    assert calls["linux_build"][0]["clone_submodules"] is False
+
+
 def test_job_skip_artifact_branch(
     monkeypatch: pytest.MonkeyPatch, tmp_path: Path, template_vmx: Path
 ) -> None: