validate.yml templates (assembly root and family root): CI still reads .gitmodules sections git ignores ([submodule ""], a .. name, a url with no path, a non-submodule section, a file git refuses), so the App token and the lists name repositories git never fetches #786

Goal: the two validate.yml templates read .gitmodules the way git does, by the same rules #775 (#733) gives the doctor and siblings.py. A section git ignores, or a file git refuses, then never puts a repository into the App token or the lists. CI, the doctor and git submodule agree.

Filed by lane openRepoShape-3 under v1.1.1, on Brett Heap's word of 2026-10-16T13:35:28Z ("yes create v1.1.1"). Lane 3's reviewer RV-c measured it while reviewing #782 (#741), as SHOULD 3 (#782 (comment)). Main does the same, so it is not a regression of #782; #741's scope was the space split.

What happens (measured on #782's head 1bb59b6a, and on main). None of the following gets a url from git submodule init, yet CI's steps still name it in the token, list it, or both:

• [submodule ""] and [submodule "../a"] with a GitHub url are named in the App token;
• a section with a url and no path names Nowhere;
• a [remote "origin"] url inside .gitmodules names Other;
• a bare url elsewhere in the file makes git refuse the whole file, yet CI still lists A plus an empty line;
• url = -oProxyCommand=x is listed (it is not named in the token).

Risk: where the extra repository is one the App installation cannot reach, the token step fails the job, although git would never fetch it.

What to do:

• Smallest first step: keep only submodule.?*.url keys (case "$key" in submodule.?*.url) ;; *) continue ;; esac, a plain string match).
• Then apply shape-doctor.py and siblings.py: a .gitmodules section git ignores ([submodule ""], a .. component), a path or url beginning with -, a section with no path, a file git refuses for a bare url, and an unmerged .gitmodules name no mount url, NEXT line or clone, where git says No url found and exits 128 (#733) #775's rules in shell:
  • skip an empty name, or one with a .. component;
  • skip a url or path beginning with -;
  • skip a section with no path;
  • read nothing while .gitmodules is unmerged;
  • refuse the whole file (no names, and a clear message) where git would: a bare valued key, or an update, shallow or fetchRecurseSubmodules value git dies on.
• Tests: one row per rule, for both templates, through the three steps, each compared with git submodule init the way validate.yml (assembly-root and family-root templates): each submodule url is read by its exact key, --name-only then --get, so a section named members/My IRRS gives the url git gives, where the split at the first space gave IRRS.url <url>, left that repository out of the App token and listed it wrong in both failure steps (#741) #782's tests compare.
• Both files are pinned template copies, so each project and each holder sees an upstream-changed row.

Lands after #782 (#741), and after #775 (#733) so the rules match.