Fetch, pull --ff-only, then refuse unless clean and HEAD == origin/main; the commit label is read after the pull. Test with a stub docker: 6 cases; the old script gets 5 wrong. Evidence for the catalog gate unclean-boot-images.
