feat(git-sync): vendor IO engine (pull/push/git/settings) with GitSyncClient seam (Phase A.3)

Vendor the IO engine from docmost-sync into packages/git-sync/src/engine:
- git.ts (VaultGit, execFile shell-out — verbatim)
- pull.ts (readExisting, computePullActions, applyPullActions)
- push.ts (classifyRenameMoves, computePushActions, applyPushActions, runPush)
- settings.ts adapted (pure parseSettings + Settings type; no process.env binding
  — the server builds Settings from EnvironmentService later), config-errors.ts.
CLI main()/import.meta entrypoints dropped (server drives in-process).

Client seam: new engine/client.types.ts defines GitSyncClient; pull.ts/push.ts
now use Pick<GitSyncClient, ...> instead of the non-vendored DocmostClient. Engine
logic byte-identical except a zod4-compat fix in config-errors (zod4 dropped the
issue.received==='undefined' signal; match /received undefined/ on the message).

Ported the engine unit tests (compute/apply pull+push actions, classify-rename-
moves, run-push, settings, config-errors) incl. real-git temp-repo tests: 431
pass / 3 expected-fail (was 314/3). REST/CLI-coupled upstream tests skipped
(noted). CJS build clean. No apps/server wiring yet (next step).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/git-sync/src/index.ts

@@ -44,3 +44,71 @@ export { stabilizePageFile } from "./engine/stabilize";
 export type { PageMeta } from "./engine/stabilize";
 
 export { bodyHash } from "./engine/loop-guard";
+
+// IO engine (plan §2.1/§3.1): the client seam, the VaultGit git wrapper, the
+// pull (Docmost->FS) + push (FS->Docmost) planners/appliers, and the (pure)
+// settings parser. The engine consumes the native `GitSyncClient` seam (server
+// implements it) — the upstream REST `DocmostClient` is NOT vendored.
+export type { GitSyncClient, GitSyncPageNodeLite } from "./engine/client.types";
+
+export {
+  VaultGit,
+  vaultGitEnv,
+  buildCommitMessage,
+  BOT_AUTHOR_NAME,
+  BOT_AUTHOR_EMAIL,
+  DEFAULT_BRANCH,
+} from "./engine/git";
+export type { DiffEntry, MergeResult, CommitOptions } from "./engine/git";
+
+export {
+  readExisting,
+  computePullActions,
+  applyPullActions,
+} from "./engine/pull";
+export type {
+  ReadExistingDeps,
+  PullActionsInput,
+  PullActions,
+  ApplyPullActionsDeps,
+  ApplyResult,
+} from "./engine/pull";
+
+export {
+  classifyRenameMoves,
+  computePushActions,
+  applyPushActions,
+  runPush,
+  parentFolderFile,
+  parseArgs,
+  LAST_PUSHED_REF,
+  DOCMOST_BRANCH,
+  LOCAL_AUTHOR_NAME,
+  LOCAL_AUTHOR_EMAIL,
+  LOCAL_SOURCE_TRAILER,
+} from "./engine/push";
+export type {
+  CreateAction,
+  UpdateAction,
+  DeleteAction,
+  RenameMoveAction,
+  RenameMoveActionClassified,
+  ClassifyRenameMovesDeps,
+  PushActions,
+  PushActionsInput,
+  MetaSide,
+  ApplyPushDeps,
+  WrittenBackPage,
+  PushedPageRecord,
+  PushFailure,
+  PushNoop,
+  ApplyPushResult,
+  PushDeps,
+  PushRunResult,
+  PushParsedArgs,
+} from "./engine/push";
+
+export { parseSettings, envSchema } from "./engine/settings";
+export type { Settings } from "./engine/settings";
+
+export { loadSettingsOrExit } from "./engine/config-errors";