homehub: implement + validate sync, tombstones, manifest, alerts

Tested end-to-end with two throwaway homes against a scratch hub root:
deletion propagation, new-machine join safety, edit-wins-over-delete,
reaping, forget, alert timing. Fixes found by those tests:
 - harvest deletions BEFORE the pull (pull used to undo every deletion)
 - gate attribution on $STATE/seen (a new machine would have tombstoned
   every hub file its peers had just uploaded)
 - active_path probed '+ /dir***' instead of '+ /dir/***' -> every tombstone
   looked out-of-scope, so deletions never applied
 - tombstone excludes must precede includes in the filter (first match wins)
 - rsync must get -e with the deploy key; harvest stderr must not be dropped
 - guard hub sync root that already holds unrelated data (178 G here)
 - scrub credentials out of repo remote URLs before publishing the manifest

README.md

@@ -5,7 +5,7 @@ is only the operational half.
 
 ```
 ~/homehub/
-  bin/homehub                the tool (~450 lines of bash + one python merge)
+  bin/homehub                the tool (~750 lines of bash + one python merge)
   config                     machine-specific settings (per-machine, not synced)
   rules/denylist               DEFAULT DENY, emitted first, wins over everything
   rules/sets.d/*.list          named path-lists ("sets")