feat(client): sync --force to escape the locally-modified skip

Managed items with local modifications were kept (skip + warn) with no
escape hatch other than deleting the deployed file by hand — after an
upstream change the deployed content silently stayed old, which reads
exactly like a stale cache.

--force turns the two skip cases into update (repository version wins)
and remove (upstream deleted + modified). Unmanaged items and never-
managed path occupancies stay untouched even with --force; the default
behavior is unchanged.

README.md

@@ -196,6 +196,11 @@ repository, the local manifest and the on-disk content:
 - upstream deleted & unmodified → **remove**
 - upstream deleted & modified → **skip + warn** — your version stays
 
+With `--force` the two skip cases turn into **update** and **remove** —
+the repository version wins over local modifications. Unmanaged items
+(leave + warn) are never touched, even with `--force`; neither are paths
+occupied by items agent-lib never deployed.
+
 Sync is idempotent (a second run is a byte-level no-op) and fails cleanly:
 an unreachable repository never leaves a half-deployed machine. The default
 branch is resolved from the remote's advertised `HEAD`, so a sync without
@@ -275,7 +280,7 @@ flag that drives the non-zero exit code — suitable for headless drift checks.
 | `error: … include entry "x" not found upstream` | Typo, or the item was renamed/removed upstream. Fix the lockfile include list, or re-add with a corrected `--include`. |
 | `error: … collides with own skills "x"` | Deployed-name collision. Add `--rename <upstream>=<deployed>` (add) or fix the rename map (update). |
 | `validate` reports tree/lockfile divergence | Someone edited `external/` by hand. Re-run `vendor update <source>` to restore the pinned state. |
-| Skill didn't update, `skipped (local modifications kept): 1` | Working as designed — you edited the deployed item. Restore the company version by deleting the local copy and re-syncing. |
+| Skill didn't update, `skipped (local modifications kept): 1` | Working as designed — you edited the deployed item. Run `agent-lib sync --force` to overwrite local modifications with the repository version, or delete the local copy and re-sync. |
 | `status` exits 1 | Local modifications block repository updates (or occupy names the repo needs). See `status` output for the item list. |
 | Sync fails with clone/fetch error | Work repository unreachable, or token expired. Previous local state remains intact; fix config/network and re-run. |
 | No toast on Windows | Toasts need an interactive user session — the scheduled task must run as the logged-in user, not SYSTEM. |