feat: status command + windows toast notifications

- status: read-only report of deployed/repository revision, pending changes,
  skipped items (with reasons), unrecognized local items, binary version;
  --json machine-readable; exit 1 when local modifications block repository
  updates (headless drift checks)
- sync/status share a read-only prepare() front half
- notify package: windows toast via PowerShell script (go-toast mechanism,
  zero deps, build-tag gated), noop on linux/macos; cross-compile verified
- toast fires exactly once per sync with warnings, never for routine syncs;
  notification failures are logged and never fail the sync (fail-open)

internal/notify/notify.go

@@ -0,0 +1,9 @@
+// Package notify fires user-facing notifications. The platform sender is a
+// Windows toast (PowerShell-backed, mirroring go-toast's script); Linux and
+// macOS are deliberate no-ops.
+package notify
+
+// Sender delivers one notification.
+type Sender interface {
+	Send(title, body string) error
+}