Gitea's per-job token is scoped to the calling repo, so cross-repo private submodules (micromelon-kicadlibs, micromelon_3d) fail with 'Repository not found'. Callers now pass SUBMODULE_TOKEN, a PAT scoped to read:repository, through to actions/checkout.