file_sync: config-driven replacement for hardcoded auth sync

Replace the three hardcoded host→guest credential syncs (opencode,
claude, pi) with a generic `[[file_sync]]` config list. Default is
empty — users opt in to exactly what they want synced, with no
surprise about which tools banger "supports".

```toml
[[file_sync]]
host = "~/.local/share/opencode/auth.json"
guest = "~/.local/share/opencode/auth.json"

[[file_sync]]
host = "~/.aws"          # directories are copied recursively
guest = "~/.aws"

[[file_sync]]
host = "~/bin/my-script"
guest = "~/bin/my-script"
mode = "0755"            # optional; default 0600 for files
```

Semantics:
- Host `~/...` expands against the host user's $HOME. Absolute host
  paths are used as-is.
- Guest must live under `~/` or `/root/...` — banger's work disk is
  mounted at /root in the guest, so that's the syncable namespace.
  Anything outside is rejected at config load.
- Validation at config load: reject empty paths, relative paths,
  `..` traversal, `~user/...`, malformed mode strings. Errors name
  the offending entry index.
- Missing host paths are a soft skip with a warn log (existing
  behaviour). Other errors (read, mkdir, install) abort VM create.
- File entries: `install -o 0 -g 0 -m <mode>` (default 0600).
- Directory entries: walked in Go; each source file is installed
  with its own source permissions preserved. The entry's `mode` is
  ignored for directories.

Removed (all dead after this):
- `ensureOpencodeAuthOnWorkDisk`, `ensureClaudeAuthOnWorkDisk`,
  `ensurePiAuthOnWorkDisk`, the shared `ensureAuthFileOnWorkDisk`,
  their `warn*Skipped` helpers, `resolveHost{Opencode,Claude,Pi}AuthPath`,
  and the work-disk relative-path + default display-path constants.
- The capability hook registering the three syncs now calls the
  generic `runFileSync` once.

Seven tests exercising the old codepath deleted; six new tests cover
the new runFileSync (no-op on empty config, file copy, custom mode,
missing-host-skip, overwrite, recursive directory). Config-layer
test adds happy-path parsing and a case-per-shape table of invalid
entries (empty, relative host, guest outside /root, '..' traversal,
`~user`, bad mode).

README updated: replaces the "Credential sync" section with a
"File sync" section showing the new config shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -153,19 +153,33 @@ Commonly set:
 
 Full key list in `internal/config/config.go`.
 
-## Credential sync
+## File sync
 
-If these host auth files exist, banger syncs them into the guest at
-VM start:
+Host → guest file/directory copies, declared per-user in
+`~/.config/banger/config.toml`:
 
-| Host | Guest |
-|------|-------|
-| `~/.local/share/opencode/auth.json` | `/root/.local/share/opencode/auth.json` |
-| `~/.claude/.credentials.json` | `/root/.claude/.credentials.json` |
-| `~/.pi/agent/auth.json` | `/root/.pi/agent/auth.json` |
+```toml
+[[file_sync]]
+host = "~/.local/share/opencode/auth.json"
+guest = "~/.local/share/opencode/auth.json"
 
-Host-side changes take effect after the VM restarts. Session/history
-directories are not copied.
+[[file_sync]]
+host = "~/.aws"          # whole directory, recursive
+guest = "~/.aws"
+
+[[file_sync]]
+host = "~/bin/my-script"
+guest = "~/bin/my-script"
+mode = "0755"            # optional; defaults to 0600 for files
+```
+
+Runs at `vm create` time. Each entry copies `host` → `guest` onto
+the VM's work disk (mounted at `/root` in the guest). Guest paths
+must live under `~/` or `/root/...`. Host-side changes take effect
+after the next `vm create`. Missing host paths are a soft skip with
+a warning in the daemon log.
+
+Default is no entries — add the ones you want.
 
 ## Web UI (experimental)