queen: the entrypoint cannot leave a stale t27 tree when untracked files block the checkout (Queen reads c925f20804, not origin/master) #1747

What happens

The deploy of 56c5df7 (Railway deployment 9fcef88d, live 2026-10-10 14:13Z) logged this:

[entrypoint] checkout present at /workspace/t27; fetching master
   9a73c98837..b8100e8532  master     -> origin/master
error: The following untracked working tree files would be overwritten by checkout:
	specs/port/browseros/trios/agent-server/apps/server/src/skills/migrate.t27
	specs/port/scripts/gen_w381.t27
	specs/port/tools/ternary_model.t27
	... (about 60 paths, all under specs/port/)
Aborting
[entrypoint] checkout blocked by 12 uncommitted path(s); stashing them
error: The following untracked working tree files would be overwritten by checkout:
	...
[entrypoint] checkout still failed; continuing on the existing tree
[entrypoint] checkout ready: c925f20804 on master

c925f20804 is not on GitHub: it is a local commit in the volume's root checkout. The Queen therefore reads a t27 tree that is not origin/master, on every deploy, for as long as those untracked files sit in the root. master has tracked the same paths since 2026-09-21 (specs/port/tools/ternary_model.t27) through 2026-10-07 (queen-public-agents.t27).

Why the recovery does not recover

docker-entrypoint.sh stashes tracked changes only. It says: "Untracked files never block checkout -B anyway." That claim is false when the target tracks the same path; git then refuses with "untracked working tree files would be overwritten". The stash leaves those files in place, and the retry fails on the same list.

Fix

When the retry fails, move exactly the untracked paths that the target tracks into .git/entrypoint-set-aside/<UTC time>/, keeping each relative path, and try the checkout once more.

• Nothing is deleted. That keeps the script's own rule: nothing here may destroy work it did not write.
• .worktrees/ is untouched, because the target does not track it.

The fix lands on actors-next-2, the next ship batch. It is a pure fix, so it needs no flag.

Acceptance criteria

• A local reproduction fails on the current script with "checkout still failed": an origin whose master tracks a path the clone has as an untracked file.
• With the fix, the same reproduction checks out FETCH_HEAD. The untracked file is found byte-identical under .git/entrypoint-set-aside/<time>/<same path>.
• Untracked files that the target does not track stay where they are.
• After the next deploy, the log reads checkout ready: <origin/master sha> on master.

Part of #1729 (night loop ledger).

Boundary

trios/agent-server/docker-entrypoint.sh