#267 Add safe one-way directory synchronization

[bsutton]

Fixes #267

Summary

• add one-way sync SOURCE --to DESTINATION planning and atomic commit flow
• compare file content with SHA-256; add, replace, remove, and skip unchanged entries
• store canonical host path, filesystem identity, and rules in the existing encrypted variable tree
• add dry-run/JSON output, include/exclude rules, explicit deletion, host-path rebinding, and empty/large-delete guards
• handle file-to-directory and directory-to-file transitions
• add host-path completion, CLI help, how-to, changelog, and security guidance
• support dot-prefixed hidden variable namespaces; variable list -a reveals them while export always omits them

Archive compatibility

• no lockbox header, TOC, page schema, or format-version changes
• LOCKBOX_FORMAT_VERSION remains 1
• synchronization profiles are normal encrypted variables at /.revault/sync/P<profile-id>

Verification

• cargo test --locked -p revault_cli (all tests passed; 2 loopback-only publish tests ignored)
• cargo test --locked -p revault_lockbox_api@0.0.4 (213 passed, 5 ignored; public API and docs passed)
• sync and completion suites passed after hidden-variable refinements
• cargo clippy --locked -p revault_lockbox_api@0.0.4 -p revault_cli --all-targets -- -D warnings
• git diff --check