v6: boot-refresh start_comfy + claude_start.sh; chmod exec by shebang

docker/refresh-workspace.sh

@@ -32,7 +32,9 @@ update_workspace_file() {
     if curl -fsSL --connect-timeout 10 --max-time 60 "${auth[@]}" "$url" -o "$tmp" \
         && head -c 2 "$tmp" | grep -q "$check"; then
         if ! cmp -s "$tmp" "$dest" 2>/dev/null; then
-            [[ "$name" == *.sh ]] && chmod 755 "$tmp" || chmod 644 "$tmp"
+            # scripts (shebang in first bytes) must stay executable, even
+            # without a .sh suffix (e.g. start_comfy); everything else 644
+            if head -c2 "$tmp" | grep -q '#!'; then chmod 755 "$tmp"; else chmod 644 "$tmp"; fi
             mv "$tmp" "$dest"
             echo "$TAG updated $name from hf.co/$REPO_ID."
         fi
@@ -43,6 +45,8 @@ update_workspace_file() {
 }
 update_workspace_file download_missing_models.sh '#!' || true
 update_workspace_file README.md '.' || true
+update_workspace_file start_comfy '#!' || true
+update_workspace_file claude_start.sh '#!' || true
 
 # 2) mirror workflows/ from the repo (temp snapshot + rsync --delete, so
 # renamed/removed workflows disappear too; local-only edits do NOT survive —