merge main: container and push-work fixes

Bringing the infrastructure fixes from main onto this branch so the two do not
drift. main touched docker/{entrypoint.sh,sylph-port,bin/push-work} and
docs/loop-task.md; this branch's only docker/ change is bin/build-reference-cli,
so there is no overlap and nothing to reconcile by hand.

docker/bin/push-work

@@ -49,8 +49,17 @@ if [ ! -s "$HOME/.git-credentials" ]; then
   exit 1
 fi
 
-# `store` reads the file we mounted; nothing is written back (it is read-only).
-git config --local credential.helper "store --file=$HOME/.git-credentials"
+# Applied to THIS COMMAND ONLY, via `-c`, never `git config --local`.
+#
+# Writing it to --local config persists it in the repository, and this repo is a
+# bind mount the host also uses -- so the host's git inherited
+# `store --file=/sylph-home/port/.git-credentials`, a path that exists only
+# inside the container, and every host push then failed with
+# `unable to get credential storage lock: No such file or directory`.
+#
+# A tool that configures a shared repository to suit itself breaks every other
+# user of that repository. Keep it to the invocation.
+CRED_HELPER="store --file=$HOME/.git-credentials"
 
 ahead=$(git rev-list --count "origin/$branch..$branch" 2>/dev/null || git rev-list --count HEAD)
 echo "push-work: $branch — $ahead commit(s) to publish"
@@ -63,5 +72,5 @@ fi
 # --force-with-lease is deliberately NOT offered. If this is rejected as
 # non-fast-forward, someone else moved the branch: fetch and merge, do not
 # overwrite.
-git push --set-upstream origin "$branch"
+git -c "credential.helper=$CRED_HELPER" push --set-upstream origin "$branch"
 echo "push-work: pushed $branch"