fix(git-sync): address PR #119 review (#1571)

Resolve the code-review findings from comment #1571 on PR #119.

Engine (packages/git-sync):
- Idempotent CREATE on retry: before createPage, look the page up in the
  live Docmost tree by (parentPageId, title) and ADOPT it instead of
  duplicating when a prior cycle created it but failed to persist the
  pageId back to disk. Only trust a COMPLETE tree for the lookup; fall
  back to createPage otherwise. Covered by new tests incl. a complete=false
  regression-lock.
- Route applyPullActions diagnostics through an injected logger instead of
  bare console (thread log from the cycle).
- Add a timeout to the git execFile chokepoint (runRaw) so a hung git
  subprocess cannot wedge a sync cycle.
- Translate remaining Russian code comments to English.
- Remove dead standalone-CLI code (parseArgs/PushParsedArgs,
  parseSettings/envSchema, loadSettingsOrExit + config-errors.ts) and the
  matching index exports/specs; keep the Settings type.
- Fix the dangling docs link in package.json.
- Add a schema-surface snapshot guard so any drift in the vendored
  document schema is a loud, must-review CI failure (+ provenance header).

Server (apps/server):
- Add a configurable watchdog timeout to the spawned git http-backend so a
  stalled push cannot hold the per-space lock forever
  (GIT_SYNC_BACKEND_TIMEOUT_MS).
- Close the in-process TOCTOU window in SpaceLockService.withSpaceLock by
  reserving the slot synchronously before acquire.
- Add tests: removePage git-sync provenance (both branches), ensureServable
  force-push-protection git configs, and the phase-B+ datasource methods.

Docs / build:
- AGENTS.md: list git-sync as the fifth workspace package and note the
  three schema mirrors; fix the dangling git-sync-plan.md backlog link.
- pnpm-lock.yaml: add the missing @docmost/git-sync workspace link so
  pnpm install --frozen-lockfile (CI default) succeeds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/git-sync/src/engine/git.ts

@@ -24,6 +24,12 @@ import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
 
+// Safety net: kill a hung git subprocess. This engine performs only LOCAL git
+// operations (no network pushes), so a legitimate call never approaches this
+// bound; it only prevents an indefinitely-stuck subprocess from wedging a sync
+// cycle (the same risk the http-backend watchdog guards on the server side).
+const GIT_EXEC_TIMEOUT_MS = 120_000;
+
 /** Bot identity used for engine-authored vault commits (SPEC §7.3). */
 export const BOT_AUTHOR_NAME = "Docmost Sync";
 export const BOT_AUTHOR_EMAIL = "docmost-sync@local";
@@ -32,7 +38,7 @@ export const BOT_AUTHOR_EMAIL = "docmost-sync@local";
 export const DEFAULT_BRANCH = "main";
 
 /**
- * One row of `git diff --name-status` (SPEC §6 "ФС → Docmost"). `status` is the
+ * One row of `git diff --name-status` (SPEC §6 "FS -> Docmost"). `status` is the
  * single-letter change code (`-M` rename detection on), `path` is the (new) file
  * path; for a rename/copy (`R`/`C`) `oldPath` is the source and `path` is the
  * destination, with `score` carrying git's similarity index (0–100).
@@ -146,6 +152,7 @@ export class VaultGit {
           // can be sizable.
           ...(cwd !== undefined ? { cwd } : {}),
           maxBuffer: 64 * 1024 * 1024,
+          timeout: GIT_EXEC_TIMEOUT_MS,
           env: vaultGitEnv(opts?.env),
         },
       );
@@ -413,7 +420,7 @@ export class VaultGit {
    * the listing, e.g. `"*.md"`.
    *
    * The target wiki is RUSSIAN, so vault file names routinely contain Cyrillic
-   * (e.g. `Колонка.md`). With git's DEFAULT `core.quotepath=true`, `ls-files`
+   * (e.g. `Column.md` in Cyrillic). With git's DEFAULT `core.quotepath=true`, `ls-files`
    * returns non-ASCII paths octal-escaped and double-quoted (`"\320\232..."`),
    * which `src/pull.ts` `readExisting` would then parse as garbage paths,
    * breaking move/duplicate detection. We defeat that two ways at once:
@@ -519,7 +526,7 @@ export class VaultGit {
   /**
    * Read a ref to its SHA, or `null` if unset. Thin alias over `revParse`,
    * named for the push direction's marker `refs/docmost/last-pushed` (SPEC §5:
-   * "что из `main` уже отражено в Docmost").
+   * "what of `main` is already reflected in Docmost").
    */
   async readRef(ref: string): Promise<string | null> {
     return this.revParse(ref);