post-receive uses `git checkout -f <SHA>` which detaches HEAD in the bare
repo. Without this fix, sidecar commits advance the detached HEAD but not
refs/heads/main and are orphaned on the next push.
Also commits CLAUDE.md docs update and the retry-loop sync-vps.sh.