fix(gbrain): harden capability and sync guards

[GoloCatMash]

Summary

• replace the in-project gbrain capability write/delete probe with an isolated, owned temporary source; thin clients use only live scope and read probes
• resolve current and legacy GBRAIN_HOME layouts consistently, ignore project dotenv routing during validation, and retain compatible source metadata lookup down to gbrain 0.28
• fail closed around source removal, auto-reclone, and Autopilot races, including version-specific confirmation flags and a last-moment guard with no intervening gbrain probe
• ship imported lib/ runtime assets to every host and refresh copied Windows sidecars during upgrades

Safety properties

• no capability files are written into the caller repository
• source cleanup requires exact source-id plus owned-path readback
• user-managed checkouts are never removed without a proven keep-storage path
• unknown CLI identities stay on current fail-closed contracts
• Autopilot is rechecked after all metadata/version probes and immediately before each destructive subprocess

Test evidence

• bun test test/gbrain-guards.test.ts test/gbrain-capability-check.test.ts: 66 passed
• changed/impact suites: 645 passed with one expected Windows-only skip
• sync-related suites: 118 passed
• broad local run: 903 passed with four expected platform skips; three host-PATH isolation failures and one existing parser/collection failure were reproduced on clean origin/main
• git diff --check, shell syntax checks, generated-doc dry run, and independent pre-landing review: green

Context

Tracks the upstream half of GoloCatMash/viko#1219. The Viko issue remains blocked until this PR is merged, released, and consumed by the official gstack upgrade path.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[GoloCatMash]

/trunk merge

[trunk-io]

An error occurred while submitting your PR to the queue: Only users that are a part of this repo's Trunk organization or have write permissions to the repo can submit a PR to the queue