fix: add ESP-IDF to git safe.directory before submodule init

Root-owned /opt/esp-idf triggers git dubious ownership check when
running submodule update. Add safe.directory config beforehand.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ansible/roles/gitea-actions/tasks/esp-idf.yml

@@ -35,6 +35,13 @@
   when: not esp_idf_dir.stat.exists
   tags: gitea-actions
 
+- name: add ESP-IDF to git safe.directory
+  become: true
+  ansible.builtin.command:
+    cmd: git config --global --add safe.directory {{ esp_idf_path }}
+  changed_when: false
+  tags: gitea-actions
+
 - name: ensure ESP-IDF submodules are initialized
   become: true
   ansible.builtin.command: