feat: add safe Gitea sync and signed updates

src/main/ipc/repository-handlers.cjs

@@ -265,6 +265,44 @@ function registerRepositoryIpc({
       git.repairSync(safePath, strategy),
     );
   });
+  register("repository:workspace-sync-preview", async ({ localPath }) => {
+    const safePath = await assertKnownRepositoryPath(localPath);
+    const plan = await withRepositoryMutation(safePath, () =>
+      git.previewWorkspaceSync(safePath),
+    );
+    await diagnostics.info("repository.workspace-sync.previewed", {
+      localPath: safePath,
+      branch: plan.branch,
+      upstream: plan.upstream,
+      currentSha: plan.currentSha,
+      targetSha: plan.targetSha,
+      planId: plan.id,
+      summary: plan.summary,
+      blockers: plan.blockers,
+    });
+    return plan;
+  });
+  register(
+    "repository:workspace-sync-apply",
+    async ({ localPath, expectedPlanId }) => {
+      const safePath = await assertKnownRepositoryPath(localPath);
+      const result = await withRepositoryMutation(safePath, () =>
+        git.synchronizeWorkspace(safePath, expectedPlanId),
+      );
+      await audit.append("repository.workspace-synchronized", {
+        localPath: safePath,
+        branch: result.plan.branch,
+        upstream: result.plan.upstream,
+        previousSha: result.plan.currentSha,
+        targetSha: result.plan.targetSha,
+        backupBranch: result.backupBranch,
+        stashSha: result.stash?.sha || null,
+        ignoredFilesPreserved: true,
+        applied: result.applied,
+      });
+      return result;
+    },
+  );
   register("repository:set-origin", async ({ localPath, remoteUrl }) => {
     const safePath = await assertKnownRepositoryPath(localPath);
     return withRepositoryMutation(safePath, () =>