Fetch the two forks over HTTPS, and stop cloning 29 submodules to lint CSS

Two consequences of becoming the meta-repo, neither of which the merge itself
could have caught.

The submodule URLs were written as [email protected]: because that is how they are
pushed from here. That is a working copy's business, not the repository's:
upstream names all 29 over HTTPS, a clone with no key configured is the normal
case, and CI has no key at all. The URLs are now HTTPS; each submodule's own
origin stays SSH, which is where it belongs.

The assets job asked for `submodules: recursive` back when this repository had
two of them. It now names 29, and 27 are the rest of COSMIC -- several gigabytes
fetched per run to check that some CSS is in step with its generator. It fetches
the one it needs instead.

That one is cosmic-session, because install-assets.sh also places the session
entry point that lives in that fork. The script skips those two files with a
warning when the checkout is absent rather than failing, so a fetch that
silently stopped working would quietly reduce what the job covers instead of
turning it red. Hence the `test -f` after it.

.github/workflows/hyprcosmic.yml

@@ -116,14 +116,22 @@ jobs:
     name: assets and installer
     runs-on: ubuntu-latest
     steps:
-      # Submodules because tools/install-assets.sh also places the session entry
-      # point, which is versioned in the cosmic-session fork. The script degrades
-      # gracefully when that checkout is absent -- it warns and skips those two
-      # files -- so this still passes before the submodules exist, just with less
-      # covered.
+      # Not `submodules: recursive`. This repository names 29 of them, 27 of
+      # which are the rest of COSMIC and none of which this job touches -- the
+      # only one needed is cosmic-session, because tools/install-assets.sh also
+      # places the session entry point that lives there. Cloning the other 27 to
+      # lint some CSS would cost several gigabytes per run.
+      #
+      # The script degrades gracefully when that checkout is absent -- it warns
+      # and skips those two files -- so a failure to fetch would quietly reduce
+      # what is covered rather than fail. Hence the assertion after it.
       - uses: actions/checkout@v4
-        with:
-          submodules: recursive
+
+      - name: Fetch only the session submodule
+        run: |
+          set -eux
+          git submodule update --init --depth 1 cosmic-session
+          test -f cosmic-session/data/start-hyprcosmic
 
       # config.jsonc is generated, and the repository's rule is that it is never
       # hand-edited: every Nerd Font glyph in it comes from a codepoint table in

.gitmodules

@@ -1,10 +1,10 @@
 [submodule "cosmic-session"]
     path = cosmic-session
-	url = git@github.com:outbackdingo/hyprcosmic-session.git
+	url = https://github.com/outbackdingo/hyprcosmic-session
     branch = master
 [submodule "cosmic-comp"]
     path = cosmic-comp
-	url = git@github.com:outbackdingo/hyprcosmic-comp.git
+	url = https://github.com/outbackdingo/hyprcosmic-comp
     branch = master
 [submodule "cosmic-panel"]
     path = cosmic-panel