The ownership repair added in e5b8de8c2 is not sufficient on every Ansible privilege-escalation setup. Git may still see a different effective owner after the checkout has been recursively chowned, as demonstrated by #5065.

Pass an exact, task-scoped safe.directory setting to all 56 server-side git tasks. Keep the ownership repair as well, because it remains necessary for filesystem permissions. The two controller-side theme checkouts already use the same protection.

The `versioning: loose` package rule matched roles via `matchSourceUrls`.
For `git-tags` dependencies, `sourceUrl` only becomes known after the
datasource lookup, but Renovate resolves the versioning API before that
and never re-resolves it. The rule therefore never applied and roles
fell back to `semver-coerced`, which strips the `-N` suffix, so
`v1.0.0-9` and `v1.0.0-12` compared as equal and no update was offered.

Since the self-hosted runner took over (2026-08-30), only `-0` bumps
have been merged. A local dry-run of renovate 44.61.6 against the
current requirements.yml finds 1 update with the old rule and 9 with
this one (8 of them `-N` bumps).

Same fix as mother-of-all-self-hosting/mash-playbook@a38bae238d7eea364e9c2dbdb788fca095bc47d6
Related to https://github.com/mother-of-all-self-hosting/mash-playbook/issues/3395

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>