feat(sync): multiple disjoint sync mappings, each with its own direction

[acmore]

Completes the multi-folder sync capability on top of #155's per-path direction schema: spec.sync.paths now accepts multiple mappings, each becoming its own syncthing folder with its own direction.

sync:
  paths:
    - .:/workspace                   # primary: code, bi (or up)
    - local: ./collected
      remote: /data/results
      direction: down                # pod-generated results, pod is authority
    - local: ../datasets
      remote: /data/datasets
      direction: up                  # dataset push, local is authority

Rules

• Disjoint-only: mapping roots must be pairwise disjoint on both sides (equal or nested roots rejected at validation, lexical check). Same-root folders are impossible in syncthing (.stignore lives in the directory); nested roots would sync a subtree through two folders and reintroduce the overwrite hazards directions exist to prevent.
• Primary mapping (first entry): keeps the legacy okdev-<session> folder ID so existing sessions upgrade in place; it is the folder fanned out to mesh receivers; it is the only remote cleared by up --reset-workspace / sync reset-remote (a note is printed when extra mappings exist). Additional mappings stay local↔hub only — fleet-wide result collection remains jobs logs/cp.
• Stable IDs: extra mappings get okdev-<session>-<sha8(local:remote)>, index-independent so reordering doesn't reset folders.
• Cleanup: mappings removed from the config get their folders pruned from both syncthing instances on the next start; only exact managed ID shapes are touched (other sessions' and user-defined folders never removed — unit-tested).
• Modes: default = each folder syncs in its mapping's direction; explicit sync --mode forces all folders; the two-phase bootstrap applies per folder to bi mappings only. The sync config hash covers all pairs/directions and hashes single-mapping bi sessions identically to the legacy shape — upgrading okdev does not restart existing sessions.

Testing

• Unit: overlap validation (equal/nested/disjoint/lexical edges), per-path mode resolution incl. override and two-phase scoping, folder ID stability, prune safety, multi-pair config hash (incl. legacy-identical single-bi), ready-card/summary arrows.
• Kind e2e (new scenarios on the live smoke session): okdev validate rejects overlapping mappings; adding a second disjoint mapping (code up + results down) takes effect via config-hash restart; both folders sync in their own directions; status --details shows per-path arrows.
• gofmt -l clean; go test -race ./... passes.

🤖 Generated with Claude Code