Fix up sketch-wip handling when --commit is not specified.

If -git-remote-url and -commit are both specified, we check out
sketch-wip. We should do so always when we're in a container, so
doing that now.

The new sketch-wip stuff is weird if we're not in a container (the
"unsafe" mode without -outside-hostname). I've changed the system
prompt slightly to try to figure that out.
diff --git a/loop/agent.go b/loop/agent.go
index 52fafbd..2cf2e4c 100644
--- a/loop/agent.go
+++ b/loop/agent.go
@@ -1108,6 +1108,16 @@
 				return fmt.Errorf("git checkout -f -B sketch-wip %s: %s: %w", a.config.Commit, checkoutOut, err)
 			}
 		}
+	} else if a.IsInContainer() {
+		// If we're not running in a container, we don't switch branches (nor push branches back and forth).
+		slog.InfoContext(ctx, "checking out branch", slog.String("commit", a.config.Commit))
+		cmd := exec.CommandContext(ctx, "git", "checkout", "-f", "-B", "sketch-wip")
+		cmd.Dir = a.workingDir
+		if checkoutOut, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("git checkout -f -B sketch-wip: %s: %w", checkoutOut, err)
+		}
+	} else {
+		slog.InfoContext(ctx, "Not checking out any branch")
 	}
 
 	if ini.HostAddr != "" {
@@ -2112,6 +2122,8 @@
 	RepoRoot      string
 	InitialCommit string
 	Codebase      *onstart.Codebase
+	UseSketchWIP  bool
+	Branch        string
 }
 
 // renderSystemPrompt renders the system prompt template.
@@ -2123,8 +2135,8 @@
 		RepoRoot:      a.repoRoot,
 		InitialCommit: a.SketchGitBase(),
 		Codebase:      a.codebase,
+		UseSketchWIP:  a.config.InDocker,
 	}
-
 	tmpl, err := template.New("system").Parse(agentSystemPrompt)
 	if err != nil {
 		panic(fmt.Sprintf("failed to parse system prompt template: %v", err))