OPS-441: entrypoint — retry agent-config sync, crash-loop on persistent failure

[claude-prodromou]

Summary

• Drops the silent || echo warning fallbacks on the agent-config git clone/fetch/reset and the install.sh skills step in bin/entrypoint.sh. The prior pattern left pods running degraded — stale CLAUDE.md, missing /persist and /preflight skills — on any transient GitHub auth blip or rate-limit hit.
• Adds a retry_or_fatal helper: 1 initial attempt plus up to 3 retries on 10s/30s/60s backoff (~100s of patience). On final failure the script exits 1 so kubelet surfaces CrashLoopBackOff and the HelmRelease alert path fires.
• Same pattern applied to the four code paths the ticket flagged: the first-boot clone, the subsequent fetch + reset --hard, and the install.sh skills invocation.

Behaviour

• Success on attempt 1 → silent, identical to the previous fast path.
• Transient failure → retries with warning: <step> failed (attempt N/4); retrying in <delay>s lines, succeeds quietly once the blip clears.
• Persistent failure → 4 attempts exhausted, single FATAL: <step> failed after 4 attempts; aborting pod boot line on stderr, exit 1.

Test plan

• bash -n bin/entrypoint.sh — syntax clean.
• Manually exercised the helper with echo OK (success path) and false (failure path) — observed correct exit codes and the expected warning + FATAL log lines.
• Build green — Docker build on PR will exercise the file.
• Post-merge: temporarily firewall github.com from a pod during boot and verify it CrashLoopBackOffs with the FATAL: agent-config clone failed after 4 attempts line, rather than coming up healthy missing skills. (Acceptance criterion from the ticket.)

Plane: OPS-441

🤖 Generated with Claude Code

[codex-prodromou]

Codex review: approved.

The entrypoint hardening is narrowly scoped to agent-config clone/fetch/reset and install.sh skills. It replaces silent degraded startup with bounded retry/backoff and a fatal exit so kubelet surfaces persistent config-sync failures. Verified bash -n on the PR entrypoint, git diff --check, and both image build checks are green (build (codex), build (claude)).