agent: tag the decoder states the port pins, and stop leaking credential config

Two fixes to push-work and the policy that goes with them.

**Tags.** The port's exporter depends on sylpheed-formats BY REVISION, so a
commit of ours is part of its build -- and the commit it pinned lived on one
auto/* branch and nowhere else. Deleting that branch orphans it; squash-merging
it is worse, because squash creates NEW commits, so main appears to contain the
work while the pinned sha becomes unreachable and the port stops building for a
fresh checkout. Silently, at their build, long after the breakage.

push-work now pushes with --follow-tags, which publishes annotated tags
reachable from the pushed commits, and MISSION.md says to tag whatever the port
needs. formats-pin-2026-08-29 at 7eeae30 is the first, created after the fact.

**Credentials.** This script set credential.helper as --local config, which
PERSISTS in the repository. The repo is a bind mount the host also uses, so the
host's git inherited a path that exists only inside the container and every host
push failed with "unable to get credential storage lock". Now applied with -c to
the single push. Same fix already landed on the port side; this copy still had
the bug and would have re-leaked on the next push.

Committed with a pathspec so the agent's in-flight work is untouched.

docs/port/MISSION.md

@@ -271,6 +271,35 @@ answer is no-go by definition, not "try harder".
 **Then stop and write the go/no-go.** Do not start Ready Room work on your own
 authority.
 
+## Publishing a decoder state the port pins
+
+The port's exporter depends on `sylpheed-formats` **by revision**, so a commit of
+yours becomes part of its build. That creates an obligation that is easy to miss:
+
+⚠️ **A commit reachable only from an `auto/*` branch is not safe to pin.** If the
+branch is later deleted, or — worse — **squash-merged**, the object is orphaned.
+Squash creates *new* commits, so `main` appears to contain the work while the
+pinned sha becomes unreachable, and the port stops building for anyone doing a
+fresh checkout. Silently, at their build, long after the moment of breakage.
+
+**So when you land something the port needs, tag it:**
+
+```bash
+git tag -a formats-pin-$(date +%F) -m "what the port gets from this state"
+push-work            # --follow-tags publishes annotated tags with the branch
+```
+
+A tag is a permanent ref. It survives branch deletion and squash-merge, it is
+self-documenting in the port's `Cargo.toml`, and it fails loudly at *fetch* if it
+ever goes missing rather than silently at build.
+
+Then tell the port over the message channel that a new pin exists. It bumps
+deliberately, as its own commit — that is how it stays current without floating,
+which would only give it staleness it cannot see.
+
+`formats-pin-2026-08-29` at `7eeae30` is the first, created because the port had
+already pinned a commit that lived on one topic branch and nowhere else.
+
 ## Handing it over
 
 [`HANDOFF.md`](HANDOFF.md) is the single page the port agent reads. Keep it