ci: pre-populate cookiecutter cache to work around NTFS clone issue

Cookiecutter's gh: syntax does git clone of the default branch first,
which fails on Windows when main still has NTFS-illegal paths. Pre-clone
with --no-checkout and checkout the PR branch to seed the cache. The
actual cookiecutter command remains the same as the README.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JonZeolla

.github/workflows/ci.yml

@@ -129,6 +129,16 @@ jobs:
           git config --global user.name "CI Automation"
           git config --global user.email "ci@zenable.io"
 
+          # Pre-populate cookiecutter's cache so the gh: command doesn't need to
+          # clone main (which may still have NTFS-illegal paths before this PR merges).
+          # After merge, this is a no-op since the cache will already be valid.
+          repo_name=$(basename "${TEMPLATE_REPO}")
+          cache_dir="$HOME/.cookiecutters/${repo_name}"
+          if [[ ! -d "$cache_dir" ]]; then
+            git clone --no-checkout "https://github.com/${TEMPLATE_REPO}.git" "$cache_dir"
+            git -C "$cache_dir" checkout "${TEMPLATE_REF}"
+          fi
+
           # Same command as README, plus --checkout for the PR branch and --no-input for CI
           uvx --with gitpython cookiecutter \
             "gh:${TEMPLATE_REPO}" \