merge main: container and push-work fixes

Bringing the infrastructure fixes from main onto this branch so the two do not
drift. main touched docker/{entrypoint.sh,sylph-port,bin/push-work} and
docs/loop-task.md; this branch's only docker/ change is bin/build-reference-cli,
so there is no overlap and nothing to reconcile by hand.

docs/loop-task.md

@@ -16,8 +16,16 @@ believed later. If you need an answer the disc has not given you, write it in
 
 1. `docs/MISSION.md` — milestones, gates, scope.
 2. `/reborn/docs/port/HANDOFF.md` — **the contract.** What is decoded, what was
-   measured off the running game, and what is known undecodable. `git -C /reborn
-   pull` first; the RE agent publishes continuously.
+   measured off the running game, and what is known undecodable.
+
+   **It is a live read-only mount of the RE agent's working tree**, so it updates
+   itself and there is nothing to pull — `git -C /reborn pull` cannot work (the
+   mount is read-only) and should not: it would move another agent's checkout.
+   `git -C /reborn log -1` shows where they are.
+
+   Because it is live, **it can move under you mid-iteration.** Anything you
+   copied out of it earlier — `docs/BLOCKED.md` especially — may already be
+   stale. Re-check it against HANDOFF before trusting it.
 3. `docs/FORMAT.md` — the open format. It is versioned and it is yours to
    revise, but a change is a deliberate act with a version bump.
 4. `docs/BLOCKED.md` — what you are waiting on, so you do not re-discover it.