[codex] Fix safe student checkout and idle routing

[morganmcg1]

Summary

• Add safe student branch transitions that preserve dirty or untracked target work in timestamped git stashes before moving between advisor and assignment branches.
• Make advisor refresh and assignment checkout failures explicit, non-fatal, and visible on active assignment PRs with STUDENT-...-FAILED comments.
• Surface those checkout failure markers in advisor-action triage as student_checkout_failed.
• Filter idle students through Kubernetes worker liveness when available, so missing or not-ready pods are not routed new assignments.
• Add a focused shell regression test for idle routing with live, busy, not-ready, and missing workers.

Root Cause

The student entrypoint ran branch checkout and pull operations under set -e, while silently ignoring advisor-branch refresh failures. A dirty target checkout could therefore either mask the first useful failure or kill the student container when assignment checkout tried to replace the branch. Separately, idle routing only checked GitHub assignment labels, so a dead idle worker could still look assignable.

Validation

• bash -n k8s/entrypoint-student.sh plugins/senpai/scripts/senpai-gh.sh tests/test_senpai_gh_idle.sh
• bash tests/test_senpai_gh_idle.sh
• git diff --check
• bash k8s/test-entrypoint-advisor.sh

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}