fix: Lazily fetch external modules only if needed

fleet/user-config.nix

@@ -13,13 +13,21 @@
 # Options are defined in fleet-option.nix for early availability.
 
 let
-  # Helper: Resolve external module path from fetchGit/fetchTarball/path
+  # Helper: Resolve external module path (with lazy Git fetching)
   resolveExternalPath =
     external:
     if external == null then
       null
+    # New format: { url, rev, submodules? } - only fetch when needed
+    else if builtins.isAttrs external && external ? url && external ? rev then
+      (builtins.fetchGit {
+        inherit (external) url rev;
+        submodules = external.submodules or false;
+      }).outPath
+    # Legacy: pre-fetched derivation/package
     else if builtins.isAttrs external && external ? outPath then
       external.outPath
+    # Direct path
     else
       external;