Sync → Refuse a first sync that would orphan remote files - #130

Resolves #109

Problem

• A missing manifest is treated as a clean first sync, so the pass pushes local files and writes a fresh manifest built purely from them
• If the manifest was deleted while file objects survived (a bucket lifecycle rule, manual cleanup, a partial restore), every surviving object becomes invisible: absent from the new manifest, never pulled, never listed, orphaned forever
• listObjects existed on the storage client but sync never consulted it

Changes

• On a first sync, list the bucket and refuse the pass when it holds objects with no local file at their key, exactly the set a fresh manifest would strand; the status bar names the refusal and the log names each stranded key
• Objects that do match a local path still proceed, so an interrupted first sync (files pushed, manifest upload never landed) keeps self healing on retry
• A failed listing refuses the pass too, never guessed at as an empty bucket
• Give the sync integration tests their own geode-sync-test bucket with a full wipe between scenarios, since the first sync check lists the whole bucket

Why

• Silence must mean everything is fine; a sync that quietly strands remote files is the exact failure mode this project exists to rule out
• Refusing loudly leaves every recovery open (restore the manifest, empty the bucket, copy the files into the vault), while proceeding forecloses them all silently

Greptile Summary

This PR closes the silent-orphan hole introduced when a manifest is deleted while bucket objects survive: a first sync now lists the bucket and refuses the pass when any object has no local counterpart, naming each stranded key. Objects that do match local files still proceed, so an interrupted first sync (files pushed, manifest never landed) heals correctly on retry.

• orphanedKeys in sync.ts drives the new guard; syncOnce calls it only on first-sync paths, and a failed listing refuses rather than proceeding.
• fakeStorage.listObjects is fixed to reflect the in-memory store instead of always returning empty, making the three new unit tests meaningful.
• Sync integration tests move to a dedicated geode-sync-test bucket with a full wipe between scenarios, since the whole-bucket listing would trip the orphan refusal if leftover objects from other test files were present.

Confidence Score: 5/5

The change is additive and conservative: it only adds a refusal on the first-sync code path that previously had no listing call, and every new failure path returns early without touching the bucket.

The orphan detection logic is correct, all new failure modes return without side effects, the fakeStorage fix makes the unit tests genuinely exercise the new path, and the integration test isolation strategy is sound. No pre-existing behaviour on non-first-sync paths is touched.

No files require special attention.

Important Files Changed

_{Reviews (2): Last reviewed commit: "Address comment" | Re-trigger Greptile}