Add task sync push milestone

Tasks could start from host content in 2.2.0, but there was still no post-create path to update a live workspace from the host. This change adds the next host-to-task step so repeated fix or review loops do not require recreating the task for every local change.

Add task sync push across the CLI, Python SDK, and MCP server, reusing the existing safe archive import path from seeded task creation instead of introducing a second transfer stack. The implementation keeps sync separate from workspace_seed metadata, validates destinations under /workspace, and documents the current non-atomic recovery path as delete-and-recreate.

Validation:
- uv lock
- UV_CACHE_DIR=.uv-cache uv run pytest --no-cov tests/test_cli.py tests/test_vm_manager.py tests/test_api.py tests/test_server.py tests/test_public_contract.py
- UV_CACHE_DIR=.uv-cache make check
- UV_CACHE_DIR=.uv-cache make dist-check
- real guest-backed smoke: task create --source-path, task sync push, task exec to verify both files, task delete

docs/public-contract.md

@@ -20,6 +20,7 @@ Top-level commands:
 - `pyro mcp serve`
 - `pyro run`
 - `pyro task create`
+- `pyro task sync push`
 - `pyro task exec`
 - `pyro task status`
 - `pyro task logs`
@@ -48,6 +49,8 @@ Behavioral guarantees:
 - `pyro task create` auto-starts a persistent workspace.
 - `pyro task create --source-path PATH` seeds `/workspace` from a host directory or a local
   `.tar` / `.tar.gz` / `.tgz` archive before the task is returned.
+- `pyro task sync push TASK_ID SOURCE_PATH [--dest WORKSPACE_PATH]` imports later host-side
+  directory or archive content into a started task workspace.
 - `pyro task exec` runs in the persistent `/workspace` for that task and does not auto-clean.
 - `pyro task logs` returns persisted command history for that task until `pyro task delete`.
 - Task create/status results expose `workspace_seed` metadata describing how `/workspace` was
@@ -69,6 +72,7 @@ Supported public entrypoints:
 - `Pyro.prune_environments()`
 - `Pyro.create_vm(...)`
 - `Pyro.create_task(...)`
+- `Pyro.push_task_sync(task_id, source_path, *, dest="/workspace")`
 - `Pyro.start_vm(vm_id)`
 - `Pyro.exec_vm(vm_id, *, command, timeout_seconds=30)`
 - `Pyro.exec_task(task_id, *, command, timeout_seconds=30)`
@@ -91,6 +95,7 @@ Stable public method names:
 - `prune_environments()`
 - `create_vm(...)`
 - `create_task(...)`
+- `push_task_sync(task_id, source_path, *, dest="/workspace")`
 - `start_vm(vm_id)`
 - `exec_vm(vm_id, *, command, timeout_seconds=30)`
 - `exec_task(task_id, *, command, timeout_seconds=30)`
@@ -112,6 +117,8 @@ Behavioral defaults:
 - `allow_host_compat` defaults to `False` on `create_task(...)`.
 - `Pyro.create_task(..., source_path=...)` seeds `/workspace` from a host directory or a local
   `.tar` / `.tar.gz` / `.tgz` archive before the task is returned.
+- `Pyro.push_task_sync(...)` imports later host-side directory or archive content into a started
+  task workspace.
 - `Pyro.exec_vm(...)` runs one command and auto-cleans that VM after the exec completes.
 - `Pyro.exec_task(...)` runs one command in the persistent task workspace and leaves the task alive.
 
@@ -136,6 +143,7 @@ Advanced lifecycle tools:
 Task workspace tools:
 
 - `task_create`
+- `task_sync_push`
 - `task_exec`
 - `task_status`
 - `task_logs`
@@ -149,6 +157,8 @@ Behavioral defaults:
 - `task_create` exposes `allow_host_compat`, which defaults to `false`.
 - `task_create` accepts optional `source_path` and seeds `/workspace` from a host directory or a
   local `.tar` / `.tar.gz` / `.tgz` archive before the task is returned.
+- `task_sync_push` imports later host-side directory or archive content into a started task
+  workspace, with an optional `dest` under `/workspace`.
 - `vm_exec` runs one command and auto-cleans that VM after the exec completes.
 - `task_exec` runs one command in a persistent `/workspace` and leaves the task alive.