feat(sync): runnable FS->Docmost push (dry-run default, --apply writes)

Wire the push cycle (SPEC §6) into a runnable command; SAFE BY DEFAULT.

- runPush + main(): dry-run by default (plan only, ZERO Docmost writes, no ref
  advance); --apply is the ONLY path that builds a client and mutates Docmost
- orchestration mirrors pull.ts: assertGitAvailable -> ensureRepo ->
  merge-in-progress guard (§9/§12) -> checkout main -> commit local working tree
  (Docmost-Sync-Source: local, §7.3) -> base = refs/docmost/last-pushed else
  docmost -> diffNameStatus(base, main) -> computePushActions -> (apply) ->
  write-back created pageIds + advance refs; divergent-docmost escalates (exit 1)
- npm run push (dry-run) / npm run push -- --apply (writes; needs creds)
- fix (review Blocker): pass the WHOLE VaultGit to applyPushActions (bare method
  refs lost `this` -> --apply crashed on real git); regression test exercises the
  --apply path against a REAL VaultGit temp repo + fake client (proven to catch it)
- symmetric divergent-docmost escalation in both ff branches; dry-run logs the
  local commit explicitly; SPEC §6 notes the dry-run/local-commit behavior
- 737 -> 747 green (x2 stable); build clean; corpus STABLE

Deferred (daemon increment): FS-watcher/debounce (§7.1), git-remote push (§7.2),
continuous poll loop, pull-side §10 record consumption, fractional-index position.

SPEC.md

@@ -142,6 +142,11 @@ rename-detection, тумбстоны удалений и перенос межд
 3. Двигаем `refs/docmost/last-pushed`; фастфорвардим `docmost` (Docmost это уже
    содержит), записываем полученный `updatedAt` (§10).
 
+> `npm run push` — это **dry-run** (план без записи в Docmost), если не передан
+> `--apply`. В любом режиме он коммитит ожидающие локальные правки на `main`
+> (это нужно, чтобы посчитать diff `base..main`); такой коммит локальный и в
+> Docmost ничего не отправляет.
+
 ---
 
 ## 7. Политика «push в репу после каждого изменения»