Harden dev-bootstrap against container git trust and clone shedding

Three validated fixes for the dev base, plus corrected tail text: full-stack (spec_helper) specs run on this base now.

The commit body carries the evidence. The one caveat for operators: the new archive-tarball clone fallback has not had a fresh end-to-end up --base dev. Each piece was validated by hand on a live VM on 2026-08-30, and the script text says so where an operator will read it.