Aha, the only nondeterminism is from packing threads, so this will always yield the same file:

git -c pack.threads=1 bundle create foo.git HEAD

And cloning the result should yield deterministic clones, except for the timestamps of the files, and the contents of .git/index and .git/logs/*, which contain timestamps.