Configuration Sync and Safety

Run bookstack/pull_config.py to stage and diff. Review it. Run bookstack/apply_config.py --apply only after approval. It validates, backs up and atomically applies only the four mapped workspace files. bookstack/push_config.py publishes deliberate local edits. No script copies secrets or directly rewrites live runtime configuration.