containers: fix volume ownership and make the clone guard survive interruption

Two bugs, both mine, both found by starting the thing.

**Volume mount points must exist AND be owned by the agent before USER agent.**
Docker seeds a named volume from whatever the image has at that path, ownership
included, and creates a ROOT-OWNED directory when the path is absent. Either way
the agent cannot write, and the failure surfaced far from its cause: "clone
FAILED", with no permission error anywhere in sight. The port's own Dockerfile
already carried a comment explaining this trap, which I then walked into for
/work and /exchange.

**The clone guard checked for a .git directory, not a usable HEAD.** A clone
interrupted partway -- the container was removed while one ran -- leaves a .git
with no commits, and a presence check then skips the retry forever and hands the
agent an empty repository that looks like a checkout. It now verifies HEAD, and
clones via a temp directory so a partial result never lands in /work at all.

Also: the port launcher's path defaults still assumed the old repo root, so it
mounted no disc; and the stale /reborn notice is gone now that there is one
repository.

Verified running: both agents cloned c58196b, `share` on PATH from /work/tools,
/exchange agent-owned, canary at /canary for the decoder, disc at /disc for the
port.

docker/decoder/Dockerfile

@@ -92,8 +92,8 @@ RUN if getent passwd "${AGENT_UID}" >/dev/null; then \
     fi; \
     groupadd -g "${AGENT_GID}" agent \
     && useradd -m -u "${AGENT_UID}" -g "${AGENT_GID}" -s /bin/bash -d /sylph-home/re agent \
-    && mkdir -p /sylph-home/re /work \
-    && chown -R "${AGENT_UID}:${AGENT_GID}" /sylph-home \
+    && mkdir -p /sylph-home/re /work /exchange \
+    && chown -R "${AGENT_UID}:${AGENT_GID}" /sylph-home /work /exchange \
     && echo 'agent ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/agent
 
 COPY bin/ /usr/local/bin/