v0.21.2 — up-to-date companies receive missing settings

Fixed

• Companies already up to date still receive missing settings. The unattended driver only ever runs its installed copy, so the v0.21.1 fix alone would reach a company's .claude/settings.json only at the release after next. The driver now also reconciles settings when there is nothing to update: idempotent (nothing missing, nothing committed), stands down while a lease covers the file, adds only missing non-permission keys, and commits the result as chore(sync): reconcile .claude/settings.json with OPOS <pin> (automatic). This heals every company that applied v0.19–v0.21.1 unattended.