feat: client sync core — config, pull, inventory, manifest, OpenCode target

- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
  token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
  config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
  never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
  deterministic bytes; folder hashes over sorted relpath+filehash lines so
  tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
  both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
  is a byte-level no-op

internal/gitsource/git.go

@@ -111,6 +111,11 @@ type GitTree struct {
 	tree *object.Tree
 }
 
+// NewGitTree wraps a commit tree for discovery and materialization.
+func NewGitTree(t *object.Tree) *GitTree {
+	return &GitTree{tree: t}
+}
+
 func (g *GitTree) Walk(fn func(rel string, isDir bool) error) error {
 	walker := object.NewTreeWalker(g.tree, true, nil)
 	defer walker.Close()