Draft: feat(sync): add repo ref preflight and tunable hardening

Summary

• add a repo init ref preflight before the expensive sync phase
• add a merged manifest ref preflight using git ls-remote --exit-code
• factor repo sync flags into a single path with environment overrides
• document the new operational knobs in the image config and README

Validation

• bash -n src/build.sh
• python3 -m py_compile src/repo_ref_preflight.py

Refs #17