feat(firmware): add persistent-clone git sync spike (git_sync)

Milestone #2 increment A: the product's real publish flow, distinct from
git_push's fresh-init-per-boot throwaway branch. open-or-clone a persistent
/spiflash/repo, append to a tracked notes.md, commit on top of the branch,
and fast-forward push over mbedTLS HTTPS+PAT. Reconcile handles up-to-date
and fast-forward; a true divergence (merge commit on FATFS) is deferred to
increment B. Runs on the dedicated 96 KB git thread; gated behind `git`.

Compiles clean; on-device clone/open+fast-forward not yet hardware-verified
(clone/checkout is deeper than the proven init path — the flash may need a
GIT_STACK bump).

firmware/Cargo.toml

@@ -48,6 +48,15 @@ path = "src/bin/git_push.rs"
 harness = false
 required-features = ["git"]
 
+# Milestone #2A — persistent-clone publish cycle (clone + open + fast-forward
+# push), the product's real git flow. Same `git` gate + TW_* env + partition
+# table as git_push. Build/flash with `just flash-git-sync`.
+[[bin]]
+name = "git_sync"
+path = "src/bin/git_sync.rs"
+harness = false
+required-features = ["git"]
+
 [profile.release]
 opt-level = "s"