Wraps the recurring 'fetch upstream, rebase, verify invariants, push'
workflow into a single command with safety nets:
- creates a tag snapshot before mutating the branch
- aborts on dirty tree
- rebase by default (--merge for merge-commit instead)
- after sync, rebuilds the backend container and verifies 5 fork-only
invariants are still met (parser dropdown filtered, mitre_pct <= 100,
cache endpoints present, /sample-unlabelled present, prewarmer task
scheduled when opted in)
- exits non-zero with the recovery command if invariants regress
- optional --dry-run / --no-rebuild / --no-push for ad-hoc inspection
marc