Add task sync push milestone

Tasks could start from host content in 2.2.0, but there was still no post-create path to update a live workspace from the host. This change adds the next host-to-task step so repeated fix or review loops do not require recreating the task for every local change.

Add task sync push across the CLI, Python SDK, and MCP server, reusing the existing safe archive import path from seeded task creation instead of introducing a second transfer stack. The implementation keeps sync separate from workspace_seed metadata, validates destinations under /workspace, and documents the current non-atomic recovery path as delete-and-recreate.

Validation:
- uv lock
- UV_CACHE_DIR=.uv-cache uv run pytest --no-cov tests/test_cli.py tests/test_vm_manager.py tests/test_api.py tests/test_server.py tests/test_public_contract.py
- UV_CACHE_DIR=.uv-cache make check
- UV_CACHE_DIR=.uv-cache make dist-check
- real guest-backed smoke: task create --source-path, task sync push, task exec to verify both files, task delete

tests/test_cli.py

@@ -30,6 +30,7 @@ def test_cli_help_guides_first_run() -> None:
     assert "pyro env list" in help_text
     assert "pyro env pull debian:12" in help_text
     assert "pyro run debian:12 -- git --version" in help_text
+    assert "pyro task sync push TASK_ID ./changes" in help_text
     assert "Use `pyro mcp serve` only after the CLI validation path works." in help_text
 
 
@@ -61,6 +62,7 @@ def test_cli_subcommand_help_includes_examples_and_guidance() -> None:
 
     task_help = _subparser_choice(parser, "task").format_help()
     assert "pyro task create debian:12 --source-path ./repo" in task_help
+    assert "pyro task sync push TASK_ID ./repo --dest src" in task_help
     assert "pyro task exec TASK_ID" in task_help
 
     task_create_help = _subparser_choice(_subparser_choice(parser, "task"), "create").format_help()
@@ -71,6 +73,16 @@ def test_cli_subcommand_help_includes_examples_and_guidance() -> None:
     assert "persistent `/workspace`" in task_exec_help
     assert "pyro task exec TASK_ID -- cat note.txt" in task_exec_help
 
+    task_sync_help = _subparser_choice(_subparser_choice(parser, "task"), "sync").format_help()
+    assert "Sync is non-atomic." in task_sync_help
+    assert "pyro task sync push TASK_ID ./repo" in task_sync_help
+
+    task_sync_push_help = _subparser_choice(
+        _subparser_choice(_subparser_choice(parser, "task"), "sync"), "push"
+    ).format_help()
+    assert "--dest" in task_sync_push_help
+    assert "Import host content into `/workspace`" in task_sync_push_help
+
 
 def test_cli_run_prints_json(
     monkeypatch: pytest.MonkeyPatch,
@@ -456,6 +468,89 @@ def test_cli_task_exec_prints_human_output(
     assert "[task-exec] task_id=task-123 sequence=2 cwd=/workspace" in captured.err
 
 
+def test_cli_task_sync_push_prints_json(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    class StubPyro:
+        def push_task_sync(self, task_id: str, source_path: str, *, dest: str) -> dict[str, Any]:
+            assert task_id == "task-123"
+            assert source_path == "./repo"
+            assert dest == "src"
+            return {
+                "task_id": task_id,
+                "execution_mode": "guest_vsock",
+                "workspace_sync": {
+                    "mode": "directory",
+                    "source_path": "/tmp/repo",
+                    "destination": "/workspace/src",
+                    "entry_count": 2,
+                    "bytes_written": 12,
+                },
+            }
+
+    class StubParser:
+        def parse_args(self) -> argparse.Namespace:
+            return argparse.Namespace(
+                command="task",
+                task_command="sync",
+                task_sync_command="push",
+                task_id="task-123",
+                source_path="./repo",
+                dest="src",
+                json=True,
+            )
+
+    monkeypatch.setattr(cli, "_build_parser", lambda: StubParser())
+    monkeypatch.setattr(cli, "Pyro", StubPyro)
+    cli.main()
+    output = json.loads(capsys.readouterr().out)
+    assert output["workspace_sync"]["destination"] == "/workspace/src"
+
+
+def test_cli_task_sync_push_prints_human(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    class StubPyro:
+        def push_task_sync(self, task_id: str, source_path: str, *, dest: str) -> dict[str, Any]:
+            assert task_id == "task-123"
+            assert source_path == "./repo"
+            assert dest == "/workspace"
+            return {
+                "task_id": task_id,
+                "execution_mode": "guest_vsock",
+                "workspace_sync": {
+                    "mode": "directory",
+                    "source_path": "/tmp/repo",
+                    "destination": "/workspace",
+                    "entry_count": 2,
+                    "bytes_written": 12,
+                },
+            }
+
+    class StubParser:
+        def parse_args(self) -> argparse.Namespace:
+            return argparse.Namespace(
+                command="task",
+                task_command="sync",
+                task_sync_command="push",
+                task_id="task-123",
+                source_path="./repo",
+                dest="/workspace",
+                json=False,
+            )
+
+    monkeypatch.setattr(cli, "_build_parser", lambda: StubParser())
+    monkeypatch.setattr(cli, "Pyro", StubPyro)
+    cli.main()
+    output = capsys.readouterr().out
+    assert "[task-sync] task_id=task-123 mode=directory source=/tmp/repo" in output
+    assert (
+        "destination=/workspace entry_count=2 bytes_written=12 "
+        "execution_mode=guest_vsock"
+    ) in output
+
+
 def test_cli_task_logs_and_delete_print_human(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],