fix: remove stale git lock files before catalog sync

Catalog sync could fail permanently if the container was killed mid-fetch,
leaving behind .git/shallow.lock (or index.lock, HEAD.lock). Now cleaned
up automatically before each git fetch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/README.md

@@ -652,6 +652,7 @@ Notification preferences (email, enabled events, cooldown hours) are:
 - Periodic `git fetch` + `git reset --hard` of the app catalog repo
 - Content-hash comparison prevents unnecessary file writes
 - Post-sync stack rescan detects new/changed apps immediately
+- **Stale lock recovery**: automatically removes `.git/index.lock`, `.git/shallow.lock`, and `.git/HEAD.lock` before each fetch — prevents permanent sync failures after interrupted operations (e.g. container restart mid-sync)
 
 #### Planned Update Classifications
 

controller/internal/sync/sync.go

@@ -252,6 +252,9 @@ func (s *Syncer) gitCloneOrPull() error {
 		return s.runGit(args...)
 	}
 
+	// Remove stale git lock files left behind by interrupted operations
+	s.removeGitLockFiles()
+
 	// Pull
 	s.logger.Printf("[SYNC] Pulling latest from %s (branch: %s)", s.cfg.Git.RepoURL, s.cfg.Git.Branch)
 	if s.isDebug() {
@@ -266,6 +269,23 @@ func (s *Syncer) gitCloneOrPull() error {
 	return nil
 }
 
+// removeGitLockFiles removes stale .git/*.lock files that may have been left
+// behind if a previous git operation was interrupted (e.g. container restart).
+// These lock files prevent all subsequent git operations from succeeding.
+func (s *Syncer) removeGitLockFiles() {
+	gitDir := filepath.Join(s.cacheDir, ".git")
+	lockFiles := []string{"index.lock", "shallow.lock", "HEAD.lock"}
+	for _, name := range lockFiles {
+		lockPath := filepath.Join(gitDir, name)
+		if _, err := os.Stat(lockPath); err == nil {
+			s.logger.Printf("[SYNC] Removing stale lock file: %s", lockPath)
+			if err := os.Remove(lockPath); err != nil {
+				s.logger.Printf("[SYNC] Failed to remove lock file %s: %v", lockPath, err)
+			}
+		}
+	}
+}
+
 // buildRepoURL constructs the repo URL with optional auth credentials.
 func (s *Syncer) buildRepoURL() string {
 	url := s.cfg.Git.RepoURL