Thanks for the clarification, Jay.
After additional diagnostics, it appears that outbound HTTPS is not blocked on the host itself — direct curl requests to GitHub and raw.githubusercontent.com succeed consistently. The issue only manifests inside the bootstrap container, where git ls-remote over HTTPS intermittently hits SSL timeouts. SSH-based access to GitHub remains fully reliable, which is why I initially explored whether a clean SSH path during bootstrap might be viable.
Your point about the difficulty of rewriting all components that assume HTTPS is well taken. Given that the HTTPS failures are tied to instability in my ISP’s route to GitHub rather than a local firewall or Docker networking issue, I’ll focus on stabilizing the upstream network path instead of trying to modify the bootstrap process.
Thanks again for the guidance and for clarifying the constraints around HTTPS usage in the build pipeline.