sync-guard

Pre-push detector for silent stale-write reverts on main. Refuses a push when its net effect rolls a file back to a recent past state — the canonical multi-agent race where a fast-forward rebase succeeds but the content being pushed is stale relative to commits another session just landed.