workstation: keep non-admin infra clones fresh (hourly + at launch) [ci skip]

Non-admins (emo) need current master without manual pulls. Two layers:
- t3-provision-users reconcile gains refresh_locked_clone: fetch all
  remotes + ff-only master, guarded (on master, clean tree, upstream
  set); dirty/diverged clones are left alone with a WARN.
- start-claude.sh freshens ~/code at session launch, 15s-capped so an
  offline remote never delays the session.

Verified live on emo's clone: stale clone ff'd to tip by the
reconciler; launcher snippet ff's when clean and refuses while a
dirty file exists. Deployed to /usr/local/bin/t3-provision-users,
/etc/skel/start-claude.sh, and emo's launcher.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/workstation/skel/start-claude.sh

@@ -19,6 +19,19 @@ fi
 
 cd "$HOME/code" 2>/dev/null || cd "$HOME"
 
+# Freshen ~/code at session start so the user begins on current upstream state
+# (the hourly t3-provision-users reconcile does the same in the background).
+# Fast-forward only, and only when safe (on master + clean tree); hard 15s cap so
+# an offline remote never stalls the launch. No-op for repos without remotes.
+if [ -d "$HOME/code/.git" ]; then
+  GIT_TERMINAL_PROMPT=0 timeout 15 git -C "$HOME/code" fetch --all --prune --quiet 2>/dev/null || true
+  if [ "$(git -C "$HOME/code" symbolic-ref --short -q HEAD)" = master ] \
+     && [ -z "$(git -C "$HOME/code" status --porcelain 2>/dev/null)" ] \
+     && git -C "$HOME/code" rev-parse --verify -q 'master@{upstream}' >/dev/null 2>&1; then
+    git -C "$HOME/code" merge --ff-only 'master@{upstream}' >/dev/null 2>&1 || true
+  fi
+fi
+
 # Prefer the system-wide `claude` (installed by setup-devvm.sh); fall back to npx.
 launch() {
   if command -v claude >/dev/null 2>&1; then