containers: fix volume ownership and make the clone guard survive interruption

Two bugs, both mine, both found by starting the thing.

**Volume mount points must exist AND be owned by the agent before USER agent.**
Docker seeds a named volume from whatever the image has at that path, ownership
included, and creates a ROOT-OWNED directory when the path is absent. Either way
the agent cannot write, and the failure surfaced far from its cause: "clone
FAILED", with no permission error anywhere in sight. The port's own Dockerfile
already carried a comment explaining this trap, which I then walked into for
/work and /exchange.

**The clone guard checked for a .git directory, not a usable HEAD.** A clone
interrupted partway -- the container was removed while one ran -- leaves a .git
with no commits, and a presence check then skips the retry forever and hands the
agent an empty repository that looks like a checkout. It now verifies HEAD, and
clones via a temp directory so a partial result never lands in /work at all.

Also: the port launcher's path defaults still assumed the old repo root, so it
mounted no disc; and the stale /reborn notice is gone now that there is one
repository.

Verified running: both agents cloned c58196b, `share` on PATH from /work/tools,
/exchange agent-owned, canary at /canary for the decoder, disc at /disc for the
port.

docker/decoder/Dockerfile

@@ -92,8 +92,8 @@ RUN if getent passwd "${AGENT_UID}" >/dev/null; then \
     fi; \
     groupadd -g "${AGENT_GID}" agent \
     && useradd -m -u "${AGENT_UID}" -g "${AGENT_GID}" -s /bin/bash -d /sylph-home/re agent \
-    && mkdir -p /sylph-home/re /work \
-    && chown -R "${AGENT_UID}:${AGENT_GID}" /sylph-home \
+    && mkdir -p /sylph-home/re /work /exchange \
+    && chown -R "${AGENT_UID}:${AGENT_GID}" /sylph-home /work /exchange \
     && echo 'agent ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/agent
 
 COPY bin/ /usr/local/bin/

docker/decoder/entrypoint.sh

@@ -101,12 +101,23 @@ mkdir -p "$HOME/shots" "$HOME/logs"
 #
 # Cloned ONCE. Never auto-pulled: pulling under a running agent moves files out
 # from under whatever it is mid-edit, which is the same class of bug again.
-if [ ! -d /work/.git ]; then
+if ! git -C /work rev-parse --verify HEAD >/dev/null 2>&1; then
+  # Checks for a usable HEAD, not merely a .git directory. A clone interrupted
+  # partway -- the container stopped while it ran, which has happened -- leaves
+  # a .git with no commits, and a presence check would then skip the retry
+  # forever and hand the agent an empty repository.
   echo "[entrypoint] cloning ${SYLPH_REPO_URL:-https://git.mc02.dev/fabi/Sylpheed.git} into /work"
-  git clone --quiet "${SYLPH_REPO_URL:-https://git.mc02.dev/fabi/Sylpheed.git}" /work || {
-    echo "[entrypoint] clone FAILED -- the agent has no repository" >&2; }
+  _tmp=$(mktemp -d)
+  if git clone --quiet "${SYLPH_REPO_URL:-https://git.mc02.dev/fabi/Sylpheed.git}" "$_tmp/r"; then
+    find /work -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true
+    mv "$_tmp/r"/.[!.]* "$_tmp/r"/* /work/ 2>/dev/null || true
+    echo "[entrypoint] /work at $(git -C /work rev-parse --short HEAD) on $(git -C /work rev-parse --abbrev-ref HEAD)"
+  else
+    echo "[entrypoint] clone FAILED -- the agent has no repository" >&2
+  fi
+  rm -rf "$_tmp"
 else
-  echo "[entrypoint] /work is at $(git -C /work rev-parse --short HEAD 2>/dev/null) on $(git -C /work rev-parse --abbrev-ref HEAD 2>/dev/null)"
+  echo "[entrypoint] /work at $(git -C /work rev-parse --short HEAD) on $(git -C /work rev-parse --abbrev-ref HEAD)"
 fi
 
 # The shared exchange, for transient files that must not enter git history.

docker/decoder/sylph-decoder

@@ -234,9 +234,9 @@ case "${1:-}" in
     # wakeup cannot end the run. Set SYLPH_LOOP_INTERVAL= (empty) to self-pace.
     INTERVAL="${SYLPH_LOOP_INTERVAL-45m}"
     declare -a ARGS; docker_args ARGS
-    ARGS+=(-e SYLPH_AUTONOMOUS=1 -w "$PROJECT")
+    ARGS+=(-e SYLPH_AUTONOMOUS=1 -w /work)
     echo "==> loose  |  cpus=$CPUS  mem=${MEM_GB}g  shm=${SHM_GB}g"
-    echo "==> project: $PROJECT (mounted at its own path, so memory carries over)"
+    echo "==> repo:    own clone in volume sylpheed-decoder-repo -> /work"
     echo "==> pacing:  ${INTERVAL:-self-paced}"
     docker rm -f "$NAME" >/dev/null 2>&1 || true
     docker run -d -i -t "${ARGS[@]}" "$IMAGE" "/loop ${INTERVAL:+$INTERVAL }$TASK" >/dev/null