feat: status command + windows toast notifications

- status: read-only report of deployed/repository revision, pending changes,
  skipped items (with reasons), unrecognized local items, binary version;
  --json machine-readable; exit 1 when local modifications block repository
  updates (headless drift checks)
- sync/status share a read-only prepare() front half
- notify package: windows toast via PowerShell script (go-toast mechanism,
  zero deps, build-tag gated), noop on linux/macos; cross-compile verified
- toast fires exactly once per sync with warnings, never for routine syncs;
  notification failures are logged and never fail the sync (fail-open)

internal/notify/noop_noop.go

@@ -0,0 +1,11 @@
+//go:build !windows
+
+package notify
+
+// Noop drops every notification; Linux and macOS stay silent by design.
+type Noop struct{}
+
+func (Noop) Send(title, body string) error { return nil }
+
+// Platform returns the no-op sender on Linux and macOS.
+func Platform() Sender { return Noop{} }