Add dry-run and safe permissions to wspace env sync

[EthanThatOneKid]

Problem

wspace env sync copies local configuration from the central secrets/ vault into the canonical checkout and linked worktrees, but it currently provides no preview mode and does not explicitly enforce restrictive permissions on copied files. A user cannot safely review which destinations will be overwritten, and copied credentials may inherit an overly permissive mode from the source or filesystem defaults.

Desired behavior

Improve environment synchronization with an explicit dry-run and a secure file-permission policy.

Dry-run

• Add wspace env sync --dry-run (and JSON output support if applicable).
• Perform discovery and validation but no writes, directory creation, chmod, or deletion.
• Report each source, destination, whether the destination exists, and whether the operation would create or overwrite it.

Permissions and copying

• Copy local credential files with owner-only permissions (0600) by default.
• Apply permissions without following a symlink at the destination; reject unsafe symlink destinations rather than overwriting through them.
• Prefer a safe temporary-file-plus-rename or equivalent approach so an interrupted copy does not leave a truncated credential file.
• Keep the central vault as the source of truth and preserve the existing worktree discovery model.
• Return nonzero and identify failures when any destination cannot be safely synchronized.

Acceptance criteria

• Dry-run leaves file contents, mtimes, modes, and directory trees unchanged.
• A real sync creates or updates files with mode 0600 on supported platforms.
• Existing destination symlinks are rejected and never followed.
• Tests cover create, overwrite, dry-run, multiple linked worktrees, permission enforcement, and copy failure.
• Human and JSON output clearly distinguish planned, copied, skipped, and failed operations.
• README documentation explains the dry-run command and the permissions policy.

Non-goals

• Do not sync arbitrary files outside the configured local-file patterns.
• Do not print secret contents or include them in error messages.
• Do not delete destination files that no longer exist in the vault without an explicit future command.

[EthanThatOneKid]

Resolved in PR #18