Walk the default branch first, and keep ssh noise out of the room

Rooms mapped before the push watch existed carry no default_branch, so
the "report a commit as being on master, not on some stale branch that
also contains it" ordering never applied to them. Look it up once and
keep it.

known_hosts lives in the image, so it resets on every rebuild and the
first ssh connection printed "Permanently added ... to the list of known
hosts" straight into the room, prepended to the first assessment. Set
LogLevel ERROR in the generated ssh config; real errors still come back.

Corrects two claims in Current state that the API contradicts: the repo
has had three PRs, not zero, and their review threads for #2 and #3 are
orphaned in the room right now.

docker-entrypoint.sh

@@ -24,6 +24,7 @@ config = f"""Host {mac.get('ssh_alias', 'mac-bridge')}
     IdentitiesOnly yes
     StrictHostKeyChecking accept-new
     UserKnownHostsFile {os.environ['KNOWN_HOSTS']}
+    LogLevel ERROR
 """
 with open(os.environ['SSH_CONFIG'], "w") as f:
     f.write(config)