feat: status command + windows toast notifications

- status: read-only report of deployed/repository revision, pending changes,
  skipped items (with reasons), unrecognized local items, binary version;
  --json machine-readable; exit 1 when local modifications block repository
  updates (headless drift checks)
- sync/status share a read-only prepare() front half
- notify package: windows toast via PowerShell script (go-toast mechanism,
  zero deps, build-tag gated), noop on linux/macos; cross-compile verified
- toast fires exactly once per sync with warnings, never for routine syncs;
  notification failures are logged and never fail the sync (fail-open)

internal/cli/status.go

@@ -0,0 +1,43 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/m3tam3re/agent-lib/internal/client"
+)
+
+func newStatusCmd() *cobra.Command {
+	var configPath string
+	var asJSON bool
+	cmd := &cobra.Command{
+		Use:   "status",
+		Short: "Report deployed revision, pending changes, skips and unrecognized items",
+		Long: "Read-only local state report. Exits non-zero when local modifications " +
+			"block repository updates — suitable for headless drift checks. " +
+			"agent-lib version is included in the report.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			report, err := client.Status(client.SyncOptions{ConfigPath: configPath})
+			if err != nil {
+				return fmt.Errorf("status: %w", err)
+			}
+			if asJSON {
+				if err := emitJSON(cmd, report); err != nil {
+					return err
+				}
+			} else {
+				client.PrintStatus(cmd.OutOrStdout(), report)
+			}
+			if report.Drift {
+				os.Exit(1)
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&configPath, "config", "", "client config path (default: "+client.ConfigEnv+" env or platform default)")
+	cmd.Flags().BoolVar(&asJSON, "json", false, "machine-readable output")
+	return cmd
+}