fix(base): preview and scope environment sync writes

[masoudgolchin]

Summary

A one-key request could trigger a full replacement, and read-only commands could rewrite example headers. Environment sync now previews by default, makes one-key push the normal path for one-key requests, and requires an explicit direction when full sources differ.

The stable shell entrypoint now uses a smaller Node.js engine. It preserves example comments, handles quoted and multiline values, keeps secrets out of command arguments, distinguishes missing items from failed reads, checks for intervening vault edits, and verifies writes by reading them back.

Test plan

• All 26 tests passed, including 17 environment cases with a local 1Password test double.
• An independent forward test applied an authorized one-key request and preserved every other field and both local files.
• All 9 packages, generated metadata, shell/Node syntax, and diff checks passed.

Notes

• Refs asana#1217817153513085
• Depends on fix(git): check branch and staged scope before each commit #31; this PR contains only the environment sync change.
• Requires Node.js 22+ and the 1Password CLI. SYNC_ENV_ASSUME_YES no longer writes; use --yes after reviewing the plan.
• Vault writes use dedicated Secure Note items. Other categories are left unchanged because JSON templates cannot preserve passkeys.
• The stale-read check is not an atomic lock. A vault write and local file updates are not one transaction. Uncertain writes require inspection before retrying.
• Base pack 1.9.3; marketplace 2.13.3. No live vault or installed plugin was changed in validation.