fix(spaces): _git_clone uses init+fetch so SHA refs work

git clone --branch only accepts branch/tag names, so cloning ComfyUI by
its pinned SHA failed on Spaces with "Remote branch <sha> not found in
upstream origin". Switching to init + fetch --depth 1 origin <ref> +
checkout FETCH_HEAD, which handles branches, tags, and SHAs uniformly.

app.py

@@ -42,9 +42,20 @@ CUSTOM_NODES_PINNED: list[tuple[str, str]] = [
 
 
 def _git_clone(url: str, dst: pathlib.Path, ref: str) -> None:
+    """Clone *url* at *ref* into *dst*. *ref* may be a branch, tag, or SHA.
+
+    `git clone --branch` only accepts branch/tag names, so we use init+fetch
+    which works for any object GitHub allows fetching (default: reachable
+    commits in public repos).
+    """
     import subprocess
 
-    subprocess.check_call(["git", "clone", "--depth", "1", "--branch", ref, url, str(dst)])
+    dst = pathlib.Path(dst)
+    dst.mkdir(parents=True, exist_ok=True)
+    subprocess.check_call(["git", "-C", str(dst), "init", "-q"])
+    subprocess.check_call(["git", "-C", str(dst), "remote", "add", "origin", url])
+    subprocess.check_call(["git", "-C", str(dst), "fetch", "--depth", "1", "origin", ref])
+    subprocess.check_call(["git", "-C", str(dst), "checkout", "-q", "FETCH_HEAD"])
 
 
 def _bootstrap() -> None: