feat: add clihost rsync sync command

[axisrow]

Closes #92

Summary

• Add bin/clihost-sync.sh, a host-side rsync-over-SSH helper with pull as host -> container and push as container -> host.
• Restrict sync to the safe subset: ~/.gitconfig and ~/.config/gh only.
• Install the helper into the image at /bin/clihost-sync.sh and document usage in README, CLAUDE.md, and .env.example.

Safety checks

• Dry-run is the default; real transfers require --apply.
• Apply mode adds rsync --backup --backup-dir=....
• --delete is never passed unless --allow-delete is explicit.
• Remote preflight aborts unless the home volume is mounted exactly at /home/hapi.
• Symlink guards reject controlled /home/hapi paths and existing symlinks under the synced gh tree; rsync also uses --no-links.
• Non-goals remain out of scope: no ~/.claude, private ~/.ssh, or Claude settings.json sync.

Validation

• python -m pytest tests/ -> 387 passed
• docker build -t clihost:issue-92-sync .
• docker run --rm --entrypoint bash clihost:issue-92-sync -lc 'test -x /bin/clihost-sync.sh && /bin/clihost-sync.sh --help >/tmp/clihost-sync-help 2>&1 && grep -q "clihost-sync.sh pull" /tmp/clihost-sync-help'

[axisrow]

🔍 Local review (cycle 1)

Reviewed locally (Claude subagent + Codex companion), no bots pinged.

Verdict	Reviewer	Finding	Location
FIX	codex + claude	Option-injection: a --leading CLIHOST_SSH_TARGET (e.g. -oProxyCommand=<cmd>) is parsed by ssh as a flag → runs <cmd> on the host during preflight, before any guard. Both reviewers reproduced host RCE. Second sink: rsync source/dest.	clihost-sync.sh:108, 323
—	claude	CLEAN: fail-closed mount, --delete only via --allow-delete, dry-run default, symlink guards + --no-links, non-goals (no .claude/.ssh/settings.json), backups, port/identity validation — all verified & tested	—

FIX applied (1f0daa3): reject a target matching -* up front (die before any ssh/rsync); defence-in-depth -- end-of-options before the ssh host and rsync operands. Same class as the dashboard ProxyCommand issue (#85) — printf %q guards shell injection but not option injection.

Two regression tests: test_option_like_target_is_rejected_before_ssh_or_rsync (plants -oProxyCommand=touch <canary>, asserts abort + canary never created — fails on old code) and test_ssh_and_rsync_calls_use_end_of_options_separator. Verified behaviorally: hostile target rejected, no ProxyCommand runs. pytest tests/ → 389 passed, 208 subtests.

Note: the rest of the safety envelope was genuinely well-built and well-tested — the whole scheme hinged on this one unvalidated input.

Cycle 1/3 complete: 1 FIX (fixed, both sinks). No remaining FIX → review cycle done. Merge is yours to trigger (local mode does not auto-merge).