chore(pxgate): pre-stage builder-clone on main; fix nixos-rebuild instructions

builder-clone was on restructure/concurrency (caef217, 288 behind main).
Switched to main at d23baf8. STATUS updated with git checkout main safeguard.
Adversary idle probes all PASS @13:31Z.

machine-docs/JOURNAL-pxgate.md

@@ -80,3 +80,21 @@ Builder loop re-launched by orchestrator. Checked current state:
 - STATUS-pxgate.md M2 section has full orchestrator instructions (pull + nixos-rebuild switch)
 
 Monitoring loop active. Will poll every ≤10 min for nixos-rebuild completion.
+
+## 2026-06-13T13:35Z — Adversary verdict received + builder-clone fix
+
+Adversary pushed `review(pxgate): idle break-it probes PASS @13:31Z`. All idle probes PASS:
+- P_stability: /api/version 200 (6/6 probes from orchestrator + cc-ci)
+- P_services: all 9 Docker services 1/1
+- P_alerts: alerts/ empty
+- P_leak: no secrets in /api/version response
+- P_ping_still_404: /ping still 404 (correct)
+- Re-confirmed builder sentinel discrepancy (999 vs 0): non-blocking, code correct
+
+**Key finding from Adversary:** builder-clone on cc-ci was on branch `restructure/concurrency` at `caef217` — 288 commits behind main. Fixed:
+```
+ssh cc-ci 'cd /root/builder-clone && git checkout main && git pull'
+→ Switched to branch 'main'; fast-forwarded 288 commits to d23baf8
+```
+STATUS-pxgate.md updated to include `git checkout main` safeguard in nixos-rebuild instructions.
+Builder-clone is now pre-staged on main at d23baf8 — orchestrator only needs to run nixos-rebuild.