Native git mode fails to checkout dependencies because .git is missing

Description

When using BOSS with the native Git client:

boss config git mode native

installing a dependency fails during checkout:

🔍 Checking out github_com_paolo-rossi_delphi-jose-jwt to v3.3.1
❌ Installation failed: command failed: exit status 1
Stderr: error: pathspec 'v3.3.1' did not match any file(s) known to git

The same dependency installs correctly using the embedded Git client:

boss config git mode embedded

A manual clone and checkout using the system Git also works correctly:

git clone https://github.com/paolo-rossi/delphi-jose-jwt.git
cd delphi-jose-jwt
git checkout v3.3.1

So the tag exists and the native Git client itself is working correctly.

Cause

It seems that the native Git implementation temporarily creates the .git file pointing the module worktree to the BOSS cache during clone/fetch operations, but removes it afterwards.

CheckoutNative then executes:

cmd := exec.CommandContext(
    context.Background(),
    "git", "checkout", "-f", referenceName.Short(),
)

cmd.Dir = dirModule

without recreating the .git file first.

At this point the dependency directory under modules/ has no .git:

project/
├── .git/
└── modules/
    └── github_com_paolo-rossi_delphi-jose-jwt/
        └── <sources only, no .git>

Because Git searches parent directories for a repository, when BOSS executes git checkout inside the module directory it can resolve the parent project's .git directory instead of the dependency repository.

This explains the error:

error: pathspec 'v3.3.1' did not match any file(s) known to git

because Git is trying to find v3.3.1 in the parent project repository instead of the dependency repository.

This can be confirmed after the failed installation by running inside the dependency directory:

git rev-parse --show-toplevel
git rev-parse --git-dir

which resolves to the parent project repository.

Steps to reproduce

boss config git mode native
boss config git shallow false
boss install -d github.com/paolo-rossi/delphi-jose-jwt

Result:

🔍 Checking out github_com_paolo-rossi_delphi-jose-jwt to v3.3.1
❌ Installation failed: command failed: exit status 1
Stderr: error: pathspec 'v3.3.1' did not match any file(s) known to git

Switching to embedded mode:

boss config git mode embedded
boss install github.com/paolo-rossi/delphi-jose-jwt

works correctly.

Environment

• Windows 11
• Git for Windows 2.55.0.windows.3
• BOSS configured with git mode native
• git shallow false
• Dependency: github.com/paolo-rossi/delphi-jose-jwt
• Version selected by BOSS: v3.3.1

Expected behavior

Native mode should checkout the dependency repository using the repository stored in the BOSS cache.

Actual behavior

CheckoutNative runs git checkout from a directory without a .git file, allowing Git to discover and operate on a parent repository instead.

Besides preventing dependency installation, this could potentially be dangerous if the dependency reference (for example main, master or another branch name) also exists in the parent project.

Possible fix

CheckoutNative should recreate the .git file pointing to the cached repository before executing the native Git command, similarly to the native fetch flow, and remove it afterwards.

Alternatively, the native commands could explicitly specify the repository and worktree using --git-dir and --work-tree, avoiding parent repository discovery entirely.

The same behavior may also need to be reviewed in PullNative.