Added the drift loop: writable env mount and taproot sync

[kridaydave]

PR made by glm-5.3-flash from zcode on behalf of Kriday.
Mounts were a dead end before — you looked at your environment through glass and threw away any change you made. Now the env file is editable in the mount, edits are captured as drift on unmount, and one command reviews, re-signs, and adopts them.

Summary :

• Made the env file writable in the FUSE mount (everything else stays read-only) with writes tracked in a mount journal
• Added drift capture on unmount: edited env is parsed back into a state with a fresh hash and saved to state.drift.json
• Added taproot sync to diff baseline vs drift, re-sign with the stored key (or ephemeral/--no-sign), adopt atomically, and clean up; --dry-run, --keep, and --force flags included
• Hardened after adversarial review: sync refuses --from/--drift-out pointing at the baseline itself, identity drift (foreign repo/base, runtime or container changes) requires --force, unparseable env edits are preserved as raw bytes instead of being lost, and keystore failures warn before falling back to an ephemeral key
• Added 13 tests covering the write path, journal drift detection, env parsing edge cases, the full sync flow, and both signing paths; README status updated