CFLAGS include-injection cascades through the whole esp-idf component graph (arpa/inet.h -> sys/ioctl.h -> ...), so path 1 is out. Decide path 2: libgit2 as an esp-idf CMake component with USE_HTTPS=mbedTLS, which fixes the includes and the TLS backend together.