fix(sync): narrow the dirty-rulesets guard to per-file excludes

One uncommitted file under the synced template paths used to skip all three rsyncs for every project. On 2026-07-30 that froze every template everywhere for a full day, and five workflow files went stale in one project alone with nothing reporting it. The blast radius had no relation to what I was editing.

Each dirty path now becomes an --exclude on its own rsync. rsync honors an exclude on both sides, so a withheld file is neither overwritten nor deleted downstream. Every clean file still propagates. A dirty protocols.org skips only its own single-file transfer. A rename withholds both names, since sweeping the old copy would delete a file the project still runs mid-rename.

The run now names what it held back, so a project can see it's one file behind.

The behind-upstream guard stays all-or-nothing. That staleness lives in the destination, so there's no single source file to narrow to.

I verified it against the real checkout mid-change: 48 workflows propagated while the two files dirty at the time were withheld and named. The same run under the old guard would have synced nothing.

0 files changed, 0 insertions, 0 deletions