Fix sidecar: advance refs/heads/main after each commit

post-receive uses `git checkout -f <SHA>` which detaches HEAD in the bare
repo. Without this fix, sidecar commits advance the detached HEAD but not
refs/heads/main and are orphaned on the next push.

Also commits CLAUDE.md docs update and the retry-loop sync-vps.sh.

CLAUDE.md

@@ -12,8 +12,11 @@ pointing to `../pages` and `../blog` (outside the submodule). No symlinks.
 ```
 bincio_wiki/
   pages/          wiki content (*.md files the community edits)
-    _docs/        software documentation (shown as separate section)
+    _docs/        documentation shown as a separate section
   blog/           blog/stories content (*.md files)
+  config/         bincio-specific configuration (outside site/ submodule)
+    sections.json wiki sections and subsections (imported by Astro pages + editor)
+    i.bonsai.md   wikibonsai semantic tree (loaded by the index collection)
   assets/         user-uploaded images (gitignored; rsync'd to VPS separately)
   site/           Astro 6 app (git submodule → brutsalvadi/astro-bloomz)
   edit/           FastAPI edit server (Python, port 8001)
@@ -114,6 +117,31 @@ Debian 12 VPS. nginx serves the built site from `/var/www/bincio/wiki/`.
 FastAPI proxied from `localhost:8001` via nginx `location /api/ { proxy_pass }`.
 See `docs/vps.md` for full nginx config and deployment steps.
 
+## Edit concurrency — future work
+
+Current state: last-write-wins. No conflict detection.
+
+Planned approach (not yet implemented):
+
+1. **Git commits with attribution** — on every save, `git add <file>` +
+   `git commit -m "handle: edited page-name" --author="handle <handle@bincio.wiki>"`.
+   Requires an `asyncio.Lock` in `server.py` to serialize git operations.
+
+2. **Optimistic locking via base-hash check** — when the client loads a page
+   for editing, the server returns the current git commit hash alongside the
+   content. On save, the client sends that hash back. If `HEAD` has moved for
+   that file since then, the save is rejected with a 409 and a "pagina
+   modificata, ricarica prima di salvare" message. No lock to release, no
+   keepalive needed — the user can abandon the editor freely.
+
+3. **3-way merge (ideal)** — instead of rejecting on conflict, use
+   `git merge-file` with base = content at `baseHash`, ours = current HEAD,
+   theirs = user's new content. Different lines → automatic merge, one commit.
+   Same lines → 409 conflict error. Builds on step 2; adds it when needed.
+
+No pessimistic locking needed. Optimistic locking with 3-way merge handles
+concurrent edits gracefully without timers or "are you still there?" prompts.
+
 ## Git conventions
 
 - No `Co-Authored-By: Claude` trailers in commits