A private submodule checkout worked before repository hardening but now fails

A security hardening change reduces token permissions and suddenly only private submodule checkout begins failing in CI.