lib_baseline_ratchet.sh: a git refusal (container "dubious ownership") is reported as "this branch WROTE it" — fails closed with the wrong cause #3683

Found in the #3682 sibling sweep (0.69 batch #3669).

scripts/lib_baseline_ratchet.sh:300 and :302 test whether a ledger entry exists at the comparand with git -C "$root" cat-file -e "${ref}:${entry}" 2>/dev/null. When git itself fails (on the docker runners it refuses the bind-mounted checkout, "detected dubious ownership", exit 128), both tests are false and the row is refused with "the comparand carries no …, so this branch WROTE it".

That fails closed, which is safe, but it names the wrong cause: it blames the PR's author for writing a file when the real problem is that git could not read the tree. Same class as #3682 and aprender#3581.

done_when

• git's failure is told apart from "absent" (for example, a git -C "$root" rev-parse --git-dir probe up front, with -c safe.directory="$root", and ENV exit 2 naming git on failure), and the refusal text is only used when git answered.
• A case row with a PATH git stub that exits 128 gives ENV naming git, not "this branch WROTE it".

Refs #3682 #3669