feat: client sync core — config, pull, inventory, manifest, OpenCode target

- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
  token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
  config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
  never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
  deterministic bytes; folder hashes over sorted relpath+filehash lines so
  tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
  both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
  is a byte-level no-op

internal/cli/root.go

@@ -23,6 +23,7 @@ func NewRootCmd() *cobra.Command {
 	root.AddCommand(newVersionCmd())
 	root.AddCommand(newVendorCmd())
 	root.AddCommand(newValidateCmd())
+	root.AddCommand(newSyncCmd())
 	return root
 }
 

internal/cli/sync.go

@@ -0,0 +1,30 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/m3tam3re/agent-lib/internal/client"
+)
+
+func newSyncCmd() *cobra.Command {
+	var configPath string
+	cmd := &cobra.Command{
+		Use:   "sync",
+		Short: "Pull the work repository and deploy its content to OpenCode",
+		Long: "Pulls the fleet-configured work repository (config from --config, " +
+			"AGENT_LIB_CONFIG, or the admin-protected platform default) and deploys " +
+			"skills, commands and agents into the OpenCode runtime paths. " +
+			"Idempotent: re-running changes nothing when content and disk match.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if _, err := client.Sync(client.SyncOptions{ConfigPath: configPath}, cmd.OutOrStdout()); err != nil {
+				return fmt.Errorf("sync: %w", err)
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&configPath, "config", "", "client config path (default: "+client.ConfigEnv+" env or platform default)")
+	return cmd
+}