sync-machine-config-to-repolisted

# sync-machine-config-to-repo The goal is that `just apply` on a second machine reproduces more of this one. `just sync` covers only the reverse direction: `chezmoi re-add` refreshes files chezmoi already tracks and never surfaces a new one. This is the other half. Terse operator mode. Report decisions and paths, do not teach. With `--report-only` in $ARGUMENTS, run phases 1 through 8 and phase 12, skip phases 9 through 11: no branch, no edits, no deletions, no PR. ## 1. Preflight Change to `$(git rev-parse --show-toplevel)` first: `--source .` below resolves against the working directory, so the same call from a subdirectory reads that subdirectory as the source and reports its contents as drift, exiting 0 having checked nothing. Then run `git fetch origin`. Refuse and name the reason if any of these holds: the working tree is dirty, HEAD is not `main`, HEAD does not equal `origin/main`, `chezmoi` is not installed, `chezmoi source-path` is not `$(git rev-parse --show-toplevel)/home` (this repo sets `.chezmoiroot` to `home`, so source-path is never the checkout root itself), or `chezmoi --source . status --exclude=scripts` prints anything. Do not gate on `just diff` or on a bare `chezmoi status`: a `.chezmoiscripts/` entry without an `once_` or `onchange_` attribute runs on every apply, so both report the scripts as pending however converged the machine is, and the gate would never pass. Record `chezmoi managed --include=files,symlinks` as the managed set. Every later