fix(repo): preserve literal separate Git directory paths

`Repo._clone()` expanded `separate_git_dir` before invoking Git, so
metadata could be written under a different directory name from the one
requested. Preserve literal paths to address `GHSA-fx3j-rwgx-fr94`.

Disable expansion in the shared `Git.polish_url()` call. Normalize
path-like arguments with `os.fspath()` first so `pathlib.Path` and other
`os.PathLike` implementations remain supported. Existing path separator
conversion still applies.

Add local regression coverage for both clone APIs, three path argument
types, variable-like names, and recursive submodule initialization. Check
the metadata location, usable submodule commit, and debug output.

Git reference: checkout `d38352cd43ab9745686d697872408bc3249a153f`,
`builtin/clone.c` and `t/t5601-clone.sh`'s separate-git-dir tests.
Native Git 2.54.0 also preserved all three literal variable forms.

Validation on Python 3.14.7:
- New regression cases: 14 failed before the fix; all 22 pass after it.
- Clone/submodule suites: 261 passed, 4 skipped, and 1 expected failure.
  All 16 local configuration failures passed on targeted rerun with
  per-process `commit.gpgsign=false`, `tag.gpgsign=false`, and
  `init.defaultBranch=master`.
- `ruff check` and `ruff format --check` on changed files pass.
- `mypy` passes for all 46 checked source files.

Author: codex

git/repo/base.py

@@ -1537,7 +1537,7 @@ def _clone(
         clone_path = Git.polish_url(path) if Git.is_cygwin() and "bare" in kwargs else path
         sep_dir = kwargs.get("separate_git_dir")
         if sep_dir:
-            kwargs["separate_git_dir"] = Git.polish_url(sep_dir)
+            kwargs["separate_git_dir"] = Git.polish_url(os.fspath(sep_dir), expand_vars=False)
         multi = None
         if multi_options:
             multi = shlex.split(" ".join(multi_options))

test/test_clone.py

@@ -21,6 +21,28 @@
 import pytest
 
 
+@pytest.mark.parametrize("clone_method", ["clone", "clone_from"])
+@pytest.mark.parametrize("path_type", [str, Path, PathLikeMock])
+@pytest.mark.parametrize("name", ["$GITPYTHON_TEST_SECRET", "${GITPYTHON_TEST_SECRET}", "%GITPYTHON_TEST_SECRET%"])
+def test_clone_preserves_literal_separate_git_dir(tmp_path, monkeypatch, caplog, clone_method, path_type, name):
+    monkeypatch.setenv("GITPYTHON_TEST_SECRET", "sensitive-value")
+    caplog.set_level("DEBUG", logger="git.cmd")
+    separate_git_dir = tmp_path / name
+    options = {"separate_git_dir": path_type(str(separate_git_dir)), "allow_unsafe_options": True}
+
+    with Repo.init(tmp_path / "source") as source:
+        if clone_method == "clone":
+            cloned = source.clone(tmp_path / "clone", **options)
+        else:
+            cloned = Repo.clone_from(source.git_dir, tmp_path / "clone", **options)
+        with cloned:
+            assert (separate_git_dir / "HEAD").is_file()
+            assert separate_git_dir.samefile(cloned.git_dir)
+
+    assert not (tmp_path / "sensitive-value").exists()
+    assert "sensitive-value" not in caplog.text
+
+
 class TestClone(TestBase):
     @with_rw_directory
     def test_checkout_in_non_empty_dir(self, rw_dir):

test/test_submodule.py

@@ -52,6 +52,31 @@ def _patch_git_config(name, value):
         yield
 
 
+@pytest.mark.parametrize(
+    "name", ["module", "$GITPYTHON_TEST_SECRET", "prefix-${GITPYTHON_TEST_SECRET}-suffix", "%GITPYTHON_TEST_SECRET%"]
+)
+def test_submodule_update_preserves_literal_name(tmp_path, monkeypatch, caplog, name):
+    monkeypatch.setenv("GITPYTHON_TEST_SECRET", "sensitive-value")
+    caplog.set_level("DEBUG", logger="git.cmd")
+    with git.Repo.init(tmp_path / "source") as source, git.Repo.init(tmp_path / "parent") as parent:
+        source.git.symbolic_ref("HEAD", "refs/heads/master")
+        source.index.commit("Initial commit")
+        with _patch_git_config("protocol.file.allow", "always"):
+            parent.git.submodule("add", "--name", name, source.working_tree_dir, "module")
+        parent.index.commit("Add submodule")
+
+        with git.Repo.clone_from(parent.working_tree_dir, tmp_path / "clone") as clone:
+            clone.submodule_update(init=True, recursive=True)
+
+            modules_dir = Path(clone.git_dir, "modules")
+            assert {path.name for path in modules_dir.iterdir()} == {name}
+            with clone.submodules[0].module() as module:
+                assert (modules_dir / name).samefile(module.git_dir)
+                assert module.head.commit == source.head.commit
+
+    assert "sensitive-value" not in caplog.text
+
+
 @pytest.fixture
 def movable_submodule(tmp_path):
     """Create a committed local submodule whose logical name stays fixed when moved."""