build(git-sync): land the @docmost/git-sync package into develop, code-only (#326 step 1 / PR-A)

The git-sync converter + engine source lived only on the #119 branch; develop
had just the dead compiled build/. Bring the whole package (src + ~700 tests)
onto develop under CI, with NO consumer wired — git-sync stays fully inert in
develop (nothing in apps/server imports it), so runtime behavior is unchanged.
This unblocks #293 (extract the shared converter package from the landed source)
and lets #119's functionality land LAST, already writing the canonical format
(per the #326 landing order).

- packages/git-sync: src (lib converter + engine) + test corpus + configs.
- Remove develop's dead committed packages/git-sync/build/; gitignore it
  (built in CI/Docker via pnpm build, never committed — no src/build drift).
- pnpm-lock.yaml: add the @docmost/git-sync importer (a missing workspace
  package in the lock is a CI blocker). `pnpm install --frozen-lockfile` passes.
- NO server integration / loader / Dockerfile runtime changes (those come with
  #119 at step 6).

Verified: tsc clean; vitest 711 passed | 1 expected-fail, 0 failures, 0 type
errors; pnpm --frozen-lockfile EXIT 0; apps/server has no git-sync import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/git-sync/src/engine/loop-guard.ts

@@ -0,0 +1,29 @@
+/**
+ * Loop-guard primitives (SPEC §10). The sync engine must never re-pull its OWN
+ * write as if it were a remote edit: after a push, the next poll will see the
+ * page it just wrote with a fresh `updatedAt`. To suppress that, we key on two
+ * signals — the body HASH of what we pushed (this module) and the `updatedAt`
+ * returned by the write — recorded per page at push time.
+ *
+ * This module owns the PURE, deterministic body-hash. The CONSUMPTION on the
+ * pull side (comparing an incoming page's body hash against the last pushed hash
+ * to decide "this is our own write, ignore it") is a future increment — here we
+ * only PRODUCE the hash and the per-page push record (see `src/push.ts`).
+ */
+import { createHash } from "node:crypto";
+
+/**
+ * Stable hash of a page's markdown BODY (SPEC §10 "body hash"). Deterministic:
+ * the same input string always yields the same digest, a different input a
+ * different one. Used to recognize our own write later (loop suppression).
+ *
+ * We hash the body STRING as-is (UTF-8) with SHA-256 and return lowercase hex.
+ * SPEC §10 keys on the body hash rather than file bytes; callers decide WHAT
+ * counts as "the body" (here it is the exact string passed in — typically the
+ * self-contained markdown that was pushed). No normalization is applied: the
+ * caller is responsible for passing a canonical/stable representation if it
+ * wants hash equality across cosmetic-only differences.
+ */
+export function bodyHash(markdownBody: string): string {
+  return createHash("sha256").update(markdownBody, "utf8").digest("hex");
+}