build(git-sync): land the @docmost/git-sync package into develop, code-only (#326 step 1 / PR-A)

The git-sync converter + engine source lived only on the #119 branch; develop
had just the dead compiled build/. Bring the whole package (src + ~700 tests)
onto develop under CI, with NO consumer wired — git-sync stays fully inert in
develop (nothing in apps/server imports it), so runtime behavior is unchanged.
This unblocks #293 (extract the shared converter package from the landed source)
and lets #119's functionality land LAST, already writing the canonical format
(per the #326 landing order).

- packages/git-sync: src (lib converter + engine) + test corpus + configs.
- Remove develop's dead committed packages/git-sync/build/; gitignore it
  (built in CI/Docker via pnpm build, never committed — no src/build drift).
- pnpm-lock.yaml: add the @docmost/git-sync importer (a missing workspace
  package in the lock is a CI blocker). `pnpm install --frozen-lockfile` passes.
- NO server integration / loader / Dockerfile runtime changes (those come with
  #119 at step 6).

Verified: tsc clean; vitest 711 passed | 1 expected-fail, 0 failures, 0 type
errors; pnpm --frozen-lockfile EXIT 0; apps/server has no git-sync import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/git-sync/test/loop-guard.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest';
+import { createHash } from 'node:crypto';
+import { bodyHash } from '../src/engine/loop-guard.js';
+
+// Loop-guard body hash (SPEC §10 "хэш тела"). The hash is the signal a future
+// pull-side poll-suppression uses to recognize our OWN write. It MUST be
+// deterministic (same input -> same hash) and discriminating (different input ->
+// different hash).
+
+describe('bodyHash (pure, SPEC §10)', () => {
+  it('is deterministic — same input yields the same hash', () => {
+    const body = '# Title\n\nsome body with <span data-comment-id="x">mark</span>\n';
+    expect(bodyHash(body)).toBe(bodyHash(body));
+  });
+
+  it('differs for different input', () => {
+    expect(bodyHash('alpha')).not.toBe(bodyHash('beta'));
+    // Even a one-character difference produces a different digest.
+    expect(bodyHash('alpha')).not.toBe(bodyHash('alphb'));
+  });
+
+  it('returns lowercase sha256 hex (64 chars)', () => {
+    const h = bodyHash('hello');
+    expect(h).toMatch(/^[0-9a-f]{64}$/);
+    // Matches an independent sha256 of the same UTF-8 bytes.
+    expect(h).toBe(createHash('sha256').update('hello', 'utf8').digest('hex'));
+  });
+
+  it('hashes the empty string to the well-known sha256 empty digest', () => {
+    expect(bodyHash('')).toBe(
+      'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
+    );
+  });
+
+  it('is sensitive to UTF-8 content (Cyrillic body)', () => {
+    expect(bodyHash('Колонка')).not.toBe(bodyHash('Колонкa'));
+    expect(bodyHash('Колонка')).toBe(
+      createHash('sha256').update('Колонка', 'utf8').digest('hex'),
+    );
+  });
+});