Add SourceOS State Integrity CLI contract

[mdheller]

Purpose

Implement the operator-facing CLI surface for the SourceOS State Integrity layer.

Canonical spec: SourceOS-Linux/sourceos-spec/docs/architecture/sourceos-state-integrity-layer.md
Program tracker: SourceOS-Linux/sourceos-spec#83

Commands to add

sourceos sync status
sourceos sync doctor
sourceos sync explain <object>
sourceos sync plans
sourceos sync actors
sourceos sync schemas
sourceos sync conflicts
sourceos sync repair --dry-run
sourceos sync repair --apply
sourceos sync profiles
sourceos sync devices
sourceos sync export <workspace|profile|object>
sourceos sync import <bundle>

Requirements

• Commands must be safe-by-default.
• Destructive repair/import/delete operations must require explicit target scope.
• doctor must classify durable, rebuildable, and disposable state.
• repair --dry-run must produce a repair report before any apply path exists.
• Output must support both human-readable and machine-readable formats.
• CLI should be prepared to speak to sourceos-syncd through a local API once the daemon exists.

Initial acceptance criteria

• Stub commands exist and return structured JSON with stable fields.
• status reports daemon availability, profile, device, workspace, and degraded-state placeholders.
• doctor reports derived index health and repair recommendations.
• explain <object> returns an explicit not-found or unsupported-object response rather than a generic failure.

[mdheller]

Implementation alignment update from SourceOS-Linux/sourceos-syncd:

The current executable CLI in sourceos-syncd is not yet the broader sourceos sync ... object-registry surface. The repo already has a Python State Integrity Report implementation with this current contract:

sourceos-syncd health snapshot
sourceos-syncd health snapshot --compact
sourceos-syncd health explain --file examples/health/healthy.snapshot.json
sourceos-syncd health verify --file examples/health/healthy.snapshot.json
sourceos-syncd repair plan --file examples/health/degraded.snapshot.json

Recommended devtools sequencing:

1. first wrap current commands as:

sourceos health snapshot
sourceos health explain
sourceos health verify
sourceos repair plan

2. add broader sourceos sync status/explain/plans/actors/schemas/conflicts only after sourceos-syncd implements local event log, actor registry, schema registry, object registry, and sync plan contracts.

This avoids exposing placeholder sync commands before the underlying object model exists.