feat: client sync core — config, pull, inventory, manifest, OpenCode target

- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
  token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
  config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
  never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
  deterministic bytes; folder hashes over sorted relpath+filehash lines so
  tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
  both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
  is a byte-level no-op

internal/vendor/add.go

@@ -10,6 +10,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/m3tam3re/agent-lib/internal/deploy"
 	"github.com/m3tam3re/agent-lib/internal/discovery"
 	"github.com/m3tam3re/agent-lib/internal/gitsource"
 	"github.com/m3tam3re/agent-lib/internal/lockfile"
@@ -171,10 +172,10 @@ func materialize(workDir, name string, tree discovery.Tree, selected []discovery
 		switch it.Type {
 		case lockfile.TypeSkill:
 			dst = filepath.Join(base, dep)
-			err = copyTreeDir(tree, it.RelPath, dst)
+			err = deploy.Dir(tree, it.RelPath, dst)
 		default:
 			dst = filepath.Join(base, dep+filepath.Ext(it.RelPath))
-			err = copyTreeFile(tree, it.RelPath, dst)
+			err = deploy.File(tree, it.RelPath, dst)
 		}
 		if err != nil {
 			return nil, fmt.Errorf("materializing %s/%s: %w", it.Type, it.UpstreamID, err)
@@ -184,54 +185,6 @@ func materialize(workDir, name string, tree discovery.Tree, selected []discovery
 	return inventory, nil
 }
 
-func copyTreeDir(tree discovery.Tree, srcRel, dst string) error {
-	lister, ok := tree.(interface {
-		FilesUnder(prefix string) ([]string, error)
-	})
-	if !ok {
-		return fmt.Errorf("tree does not support directory copy")
-	}
-	files, err := lister.FilesUnder(srcRel)
-	if err != nil {
-		return err
-	}
-	if len(files) == 0 {
-		return fmt.Errorf("no files under %s", srcRel)
-	}
-	prefix := strings.TrimSuffix(srcRel, "/") + "/"
-	for _, f := range files {
-		relInside := strings.TrimPrefix(f, prefix)
-		target := filepath.Join(dst, filepath.FromSlash(relInside))
-		if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
-			return err
-		}
-		if err := writeFileFromTree(tree, f, target); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func copyTreeFile(tree discovery.Tree, srcRel, dst string) error {
-	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
-		return err
-	}
-	return writeFileFromTree(tree, srcRel, dst)
-}
-
-func writeFileFromTree(tree discovery.Tree, rel, dst string) error {
-	if mt, ok := tree.(interface {
-		MaterializeFile(rel, dst string) error
-	}); ok {
-		return mt.MaterializeFile(rel, dst)
-	}
-	data, err := tree.ReadFile(rel)
-	if err != nil {
-		return err
-	}
-	return os.WriteFile(dst, data, 0o644)
-}
-
 func reportAdd(w io.Writer, name string, src *lockfile.Source, discovered, selected []discovery.Item) {
 	counts := func(items []discovery.Item) string {
 		per := map[string]int{}