MYPREFIX needs ${ROOT}@${HOST} designator, further clarify who runs
we should also die when untracked files are present after final clean phase

often scripts do stuff at postinst phases: deploy files, change users,
etc
resolve issues with git-sh

clean runs first and last, so ideal place for manual git-sh based
management. automatic commits in setup phase were simply too fragile,
missing things happening in later phases. even more importantly, setup
handler gets overwritten by binpkg environment, while clean does not.