hardening trio: exit-retry (1.6), RTDS shadow ledger, boot clone-guard

- failed mirror-exits queue for up to 10 heartbeat retries (recovered
  exits ping Discord; exhaustion pages ⚠ EXIT STUCK and the position
  rides knowingly; in-play holds hand to the pending registry). 3 stub
  paths pass incl. the 1.6 spec's fail-fail-fill.
- every RTDS Set E detection appends a durable shadow-ledger row
  (lat_s + which trigger won) that rides the publish commit — the 24h
  go/no-go data for flipping RTDS on the live app.
- start.sh verifies the boot clone's HEAD against the GitHub API and
  re-clones stale replicas (bit twice today).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

copytrade.py

@@ -566,7 +566,22 @@ class CopyTrader:
                 self.log(f"EXIT {label} — PENDING (in-play hold)")
                 self.persist()
                 return
-            self.log(f"EXIT {label} — ORDER FAILED: {res.get('resp')}")
+            # LIVE_ROLLOUT 1.6 (built 2026-07-10): a failed mirror-exit must
+            # not silently ride to resolution — queue a bounded retry; the
+            # heartbeat re-attempts each tick and alerts ⚠ EXIT STUCK when
+            # exhausted. One entry per token; a repeat failure refreshes it.
+            retries = self.state.setdefault("exit_retries", [])
+            for r in retries:
+                if r["token"] == token:
+                    r["shares"] = max(r["shares"], sell_shares)
+                    break
+            else:
+                retries.append({"token": token, "shares": sell_shares,
+                                "label": label, "attempts": 0,
+                                "ts": int(time.time())})
+            self.log(f"EXIT {label} — ORDER FAILED: {str(res.get('resp'))[:80]}"
+                     " · queued for retry")
+            self.persist()
             return
         proceeds = res["filled_shares"] * res["price"]
         # reduce position; release cost proportionally