feat: status command + windows toast notifications

- status: read-only report of deployed/repository revision, pending changes,
  skipped items (with reasons), unrecognized local items, binary version;
  --json machine-readable; exit 1 when local modifications block repository
  updates (headless drift checks)
- sync/status share a read-only prepare() front half
- notify package: windows toast via PowerShell script (go-toast mechanism,
  zero deps, build-tag gated), noop on linux/macos; cross-compile verified
- toast fires exactly once per sync with warnings, never for routine syncs;
  notification failures are logged and never fail the sync (fail-open)

internal/client/executor.go

@@ -9,9 +9,14 @@ import (
 	"github.com/m3tam3re/agent-lib/internal/deploy"
 	"github.com/m3tam3re/agent-lib/internal/gitsource"
 	"github.com/m3tam3re/agent-lib/internal/lockfile"
+	"github.com/m3tam3re/agent-lib/internal/notify"
 	"github.com/m3tam3re/agent-lib/internal/target"
 )
 
+// Notifier delivers user-facing notifications; swap it in tests. Failures
+// never fail the sync (fail-open, logged to stdout).
+var Notifier notify.Sender = notify.Platform()
+
 // SyncReport summarizes one planner-driven sync run.
 type SyncReport struct {
 	Revision string
@@ -72,6 +77,11 @@ func ExecutePlan(tree *gitsource.GitTree, plan []PlanEntry, manifest *Manifest,
 		if err := appendWarnings(paths.LogFile, warnings); err != nil {
 			fmt.Fprintf(stdout, "warning: could not write sync log: %v\n", err)
 		}
+		title := "agent-lib sync"
+		body := fmt.Sprintf("%d item(s) kept local: modifications blocked company updates. See the sync log for details.", report.Skipped+report.Left)
+		if err := Notifier.Send(title, body); err != nil {
+			fmt.Fprintf(stdout, "warning: notification failed: %v\n", err)
+		}
 	}
 
 	printPlannedSyncReport(stdout, report)