fix(core): run state sync before docker compose up to prevent broken bind mounts

autoSyncState does git-reset-hard which replaces directory inodes on disk.
When it ran after docker compose up, the bind mount for .orch/auth/codex
(mounted as /home/dev/.codex) pointed to a deleted inode, leaving the
container with an empty CODEX_HOME directory.

This caused codex inside the container to fail with:
  "Error loading configuration: No such file or directory"

Moving autoSyncState before runDockerUpIfNeeded ensures bind mount source
directories are stable before the container starts.

Fixes #158

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: konard

packages/lib/src/usecases/actions/create-project.ts

@@ -263,6 +263,14 @@ const runCreateProject = (
     const hasAgent = finalConfig.agentMode !== undefined
     const waitForAgent = hasAgent && (finalConfig.agentAuto ?? false)
 
+    // CHANGE: run state sync before docker compose up
+    // WHY: autoSyncState does git-reset-hard which replaces directory inodes;
+    //      running it after docker-up invalidates bind mounts (e.g. .orch/auth/codex → /home/dev/.codex)
+    //      causing "Error loading configuration: No such file or directory" inside the container.
+    // REF: issue-158
+    // INVARIANT: bind mount source directories must be stable before container start
+    yield* _(autoSyncState(`chore(state): update ${formatStateSyncLabel(projectConfig.repoUrl)}`))
+
     yield* _(
       runDockerUpIfNeeded(resolvedOutDir, projectConfig, {
         runUp: command.runUp,
@@ -278,7 +286,6 @@ const runCreateProject = (
 
     yield* _(maybeCleanupAfterAgent(waitForAgent, resolvedOutDir))
 
-    yield* _(autoSyncState(`chore(state): update ${formatStateSyncLabel(projectConfig.repoUrl)}`))
     yield* _(maybeOpenSsh(command, hasAgent, waitForAgent, projectConfig))
   }).pipe(Effect.asVoid)