homehub: rsync-based home-drive sync via Synology hub

DESIGN.md is the rationale; README.md the operations half.
Four data classes: files (mtime-arbitrated two-way), git repos (manifest +
clone, never byte-synced), the browser link bar (union merge), and everything
else denied by default.

rules/denylist

@@ -0,0 +1,134 @@
+# homehub denylist — DEFAULT DENY.  Emitted FIRST so it beats every set include
+# (rsync filter rules are first-match-wins).
+#
+# Syntax — plain paths, one per line, whole line is the pattern (comments on
+# their own lines only):
+#   /Foo/    directory at the home root + its whole subtree
+#   build/   any directory named build at ANY depth + its subtree
+#   /file    a single file
+# The trailing slash is what turns it into a subtree rule.
+#
+# Measured on g9, 2026-10-24.  Everything here is machine-local or rebuildable.
+
+# --- the big trees: class B owns repos; tmp/Downloads are out by decision ---
+/git/
+/src/
+/tmp/
+/Downloads/
+
+# --- toolchains and package caches (rebuilt by the toolchain, never shared) --
+/.cache/
+/.cargo/
+/.rustup/
+/.npm/
+/.nvm/
+/.bun/
+/.deno/
+/.yarn/
+/.espressif/
+/.platformio/
+/.conan/
+/.gradle/
+/.m2/
+/go/
+/zephyr-sdk-0.17.4/
+/zephyr-sdk-0.17.0/
+/.dotnet/
+/.emscripten/
+/.emscripten_cache/
+/.dartServer/
+/.dartium/
+/.android/
+/.docker/
+/.var/
+/.local/state/homehub/
+/.local/lib/
+/.local/bin/
+/.local/share/virtualenvs/
+/.venv/
+/.pixi/
+
+# --- games / wine ----------------------------------------------------------
+/.steam/
+/.steamrt/
+/.local/share/Steam/
+/Steam/
+/.minecraft/
+/.wine/
+/.wine_games/
+/.wine_firefly/
+/.googleearth/
+/.adobe/
+/.freeeciv-placeholder/
+
+# --- browser / editor / desktop profile state: local by default (§8) --------
+# The ONLY browser data that crosses machines is the bookmark bar (class C).
+/.config/
+/.mozilla/
+/.mozilla/
+/.mozilla/
+/.thunderbird/
+/.icedove/
+/.thunderbird/
+/.thunderbird/
+/.claws-mail/
+/.icedove/
+/.electron/
+/.electron-vite/
+/.dbus/
+/.macromedia/
+/.mozilla/
+/.cache/
+/.nv/
+/.pki/
+/.lesshst/
+/.ssh/agent/
+/.claude/
+/.codex/
+/.cache/
+
+# --- build artifacts (defence in depth; class B makes most of this moot) ----
+build/
+target/
+dist/
+out/
+node_modules/
+__pycache__/
+.venv/
+.pixi/
+.zig-cache/
+.ccache/
+.meson-cache/
+_deps/
+CMakeFiles/
+_results/
+
+# --- filesystem metadata from other OSes / the NAS itself -------------------
+# @eaDir is Synology's per-directory metadata; without this rule a pull litters
+# an @eaDir directory into every synced directory it touches.
+@eaDir/
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# --- build/packaging output that lives at the home root ---------------------
+# ~/debian is a dpkg work area: 150 M of .deb/.dsc/.orig.tar.xz and extracted
+# upstream trees.  It was 86% of the first dry-run push list — build output, not
+# personal data.  Anchored so it only means ~/debian, not every debian/ subdir.
+/debian/
+
+# --- junk, locks, transient -----------------------------------------------
+.gksu.lock
+.gconfd.lock
+/core
+/lost+found/
+*.tmp
+*.swp
+*.swo
+*.bak
+*.backup
+*~
+*.log
+*.lock
+*.part
+*.crdownload