seat: fetch a role clone that is on another branch or dirty (#1611)

Row 117. At a launch, update() kept a clone that was on another branch
or dirty and ran no git in it, so its refs/remotes/origin/* stayed as
old as the last clean launch. Now those two reasons get the clean
path's fetch, with the same arguments and environment, and no merge.
The result is a new outcome, fetched, with the reason, the clone's
branch and HEAD, and origin { branch, commit } after the fetch. Every
earlier check still keeps the clone with no fetch. The launcher writes
a checkout-fetched launch-log line, and the bundle prompt names a
fetched clone's branch, commit and origin. Nothing in unsafe(),
allowed(), gitEnv() or SAFE changed.

Candidate manifest 9fa839edfb2bd04771bbac1913b142cb16aef227a1265120e0d318fb64d6a502
from Darkwing's round 1 packet (17d801f48), on BASE 559ef2287. Dewey
approved in 28443. Sage reran the full gate at the landing target with
the candidate applied.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/cli/README.md

@@ -273,8 +273,10 @@ the launcher reads the instance's credential status from the broker
 (metadata only) and makes sure the instance's workspace has a clone of each
 project in the business file (`packages/seat/README.md`, "The project
 clones"). It makes a missing clone and fast-forwards a clean one. A clone
-it leaves alone is a `checkout-kept` line in the launch log with the
-project and the reason, and the launch goes on. The bundle's prompt names
+on another branch or dirty is fetched and not merged, a `checkout-fetched`
+line in the launch log with the project and the reason (#1611). A clone it
+leaves alone is a `checkout-kept` line with the project and the reason.
+Either way the launch goes on. The bundle's prompt names
 each clone's path. Then the launcher builds the bundle in the run
 directory, spawns the runner in its bwrap sandbox (`packages/seat/README.md`,
 "The sandbox"), binds the outer bwrap process's pid and start time, adds the