containers: fix volume ownership and make the clone guard survive interruption

Two bugs, both mine, both found by starting the thing.

**Volume mount points must exist AND be owned by the agent before USER agent.**
Docker seeds a named volume from whatever the image has at that path, ownership
included, and creates a ROOT-OWNED directory when the path is absent. Either way
the agent cannot write, and the failure surfaced far from its cause: "clone
FAILED", with no permission error anywhere in sight. The port's own Dockerfile
already carried a comment explaining this trap, which I then walked into for
/work and /exchange.

**The clone guard checked for a .git directory, not a usable HEAD.** A clone
interrupted partway -- the container was removed while one ran -- leaves a .git
with no commits, and a presence check then skips the retry forever and hands the
agent an empty repository that looks like a checkout. It now verifies HEAD, and
clones via a temp directory so a partial result never lands in /work at all.

Also: the port launcher's path defaults still assumed the old repo root, so it
mounted no disc; and the stale /reborn notice is gone now that there is one
repository.

Verified running: both agents cloned c58196b, `share` on PATH from /work/tools,
/exchange agent-owned, canary at /canary for the decoder, disc at /disc for the
port.

docker/decoder/sylph-decoder

@@ -234,9 +234,9 @@ case "${1:-}" in
     # wakeup cannot end the run. Set SYLPH_LOOP_INTERVAL= (empty) to self-pace.
     INTERVAL="${SYLPH_LOOP_INTERVAL-45m}"
     declare -a ARGS; docker_args ARGS
-    ARGS+=(-e SYLPH_AUTONOMOUS=1 -w "$PROJECT")
+    ARGS+=(-e SYLPH_AUTONOMOUS=1 -w /work)
     echo "==> loose  |  cpus=$CPUS  mem=${MEM_GB}g  shm=${SHM_GB}g"
-    echo "==> project: $PROJECT (mounted at its own path, so memory carries over)"
+    echo "==> repo:    own clone in volume sylpheed-decoder-repo -> /work"
     echo "==> pacing:  ${INTERVAL:-self-paced}"
     docker rm -f "$NAME" >/dev/null 2>&1 || true
     docker run -d -i -t "${ARGS[@]}" "$IMAGE" "/loop ${INTERVAL:+$INTERVAL }$TASK" >/dev/null