feat: client sync core — config, pull, inventory, manifest, OpenCode target

- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
  token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
  config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
  never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
  deterministic bytes; folder hashes over sorted relpath+filehash lines so
  tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
  both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
  is a byte-level no-op

internal/vendor/update.go

@@ -10,6 +10,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/m3tam3re/agent-lib/internal/deploy"
 	"github.com/m3tam3re/agent-lib/internal/discovery"
 	"github.com/m3tam3re/agent-lib/internal/gitsource"
 	"github.com/m3tam3re/agent-lib/internal/lockfile"
@@ -257,10 +258,10 @@ func materializeTree(tree discovery.Tree, selected []discovery.Item, renames map
 		switch it.Type {
 		case lockfile.TypeSkill:
 			target = filepath.Join(base, dep)
-			err = copyTreeDir(tree, it.RelPath, target)
+			err = deploy.Dir(tree, it.RelPath, target)
 		default:
 			target = filepath.Join(base, dep+filepath.Ext(it.RelPath))
-			err = copyTreeFile(tree, it.RelPath, target)
+			err = deploy.File(tree, it.RelPath, target)
 		}
 		if err != nil {
 			return fmt.Errorf("materializing %s/%s: %w", it.Type, it.UpstreamID, err)