feat(consistency): T04 push seal — closed-loop writeback for automated commits

Root cause of the 501-commit pile-up in inter-hub: fix_repo() created
git commits (brief updates, T03 writebacks) but never pushed them, so
the 15-minute timer accumulated local commits indefinitely. Once real
development landed on remote the repos diverged with no self-healing path.

Changes
-------
repo_sync.py (new module)
  Extracts all git lifecycle primitives: pull_ff, push_ff,
  count_remote_ahead (C-16 input), count_local_ahead (C-17/T04 input).
  Module docstring documents the push-seal invariant and stable state.

consistency_check.py
  - Imports primitives from repo_sync; thin _detect_behind_remote wrapper
    preserves backward compat for existing callers and tests.
  - C-17 backlog guard: if local has unpushed commits from a prior failed
    push, retry before making more; skip all writes if push still fails.
  - T04 push seal: unconditional push_ff() at end of every fix_repo() run.
  - _report_needs_action: ahead_of_remote param so repos with unpushed
    backlogs are not silently skipped as "clean" by fix_all_remote().
  - Domain-slug fallback: brief no longer degrades to "(unknown)" when all
    workplans are completed — falls back to any workstream for domain context.
  - Service switched from --all --fix to --remote --all (pulls before
    fixing, skips already-clean repos).

push-seal.md (new)
  Capability documentation: the problem, the invariant, all three checks
  (C-16/C-17/T04), stable-state description, API reference, and test map.

test_repo_sync.py (new, 32 tests)
  Full coverage of all four primitives via real git repos (tmp_path).
  Includes C-17 scenario, push-seal invariant, and four end-to-end
  loop-stability tests.

test_consistency_check.py
  Four new _report_needs_action cases for the ahead_of_remote parameter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_consistency_check.py

@@ -37,6 +37,8 @@ from consistency_check import (
     render_text,
     report_to_dict,
 )
+# _detect_behind_remote and _git_pull are re-exported from consistency_check
+# for backward compat; their canonical implementations live in repo_sync.py.
 
 
 # ---------------------------------------------------------------------------
@@ -675,3 +677,25 @@ class TestReportNeedsAction:
 
     def test_background_checks_constant_contains_c08(self):
         assert "C-08" in _BACKGROUND_CHECKS
+
+    # --- ahead_of_remote (T04 push-seal integration) ---
+
+    def test_ahead_of_remote_triggers_action(self):
+        """Unpushed commits from a prior failed push must re-trigger a fix cycle."""
+        r = self._make_report([])
+        assert _report_needs_action(r, behind_remote=False, ahead_of_remote=3) is True
+
+    def test_zero_ahead_clean_is_skipped(self):
+        """Fully in-sync repo with no issues is skipped."""
+        r = self._make_report([])
+        assert _report_needs_action(r, behind_remote=False, ahead_of_remote=0) is False
+
+    def test_ahead_default_is_zero(self):
+        """Default value of ahead_of_remote=0 preserves backward compat."""
+        r = self._make_report([])
+        assert _report_needs_action(r, behind_remote=False) is False
+
+    def test_both_behind_and_ahead_triggers(self):
+        """Diverged repo (both behind and ahead) needs action."""
+        r = self._make_report([])
+        assert _report_needs_action(r, behind_remote=True, ahead_of_remote=5) is True