feat(#2554): add hivectl forge reconcile-config to reconcile local applied config against forge main

docs/tools/hivectl-cli.md

@@ -7,6 +7,7 @@ This document contains the help content for the `hivectl` command-line program.
 * [`hivectl`↴](#hivectl)
 * [`hivectl forge`↴](#hivectl-forge)
 * [`hivectl forge create-user`↴](#hivectl-forge-create-user)
+* [`hivectl forge reconcile-config`↴](#hivectl-forge-reconcile-config)
 * [`hivectl matrix`↴](#hivectl-matrix)
 * [`hivectl matrix create-user`↴](#hivectl-matrix-create-user)
 * [`hivectl matrix sync-admin`↴](#hivectl-matrix-sync-admin)
@@ -99,6 +100,7 @@ Manual entry point to the same idempotent provisioning c0re runs at boot — for
 ###### **Subcommands:**
 
 * `create-user` — Create or refresh the Forgejo account + token for `<name>`
+* `reconcile-config` — Show + reconcile the divergence between an agent's local applied config checkout and its forge `agent-configs/<agent>` main
 
 
 
@@ -121,6 +123,32 @@ For an existing agent, persists the token to its state dir; for a human/other ac
 
 
 
+## `hivectl forge reconcile-config`
+
+Show + reconcile the divergence between an agent's local applied config checkout and its forge `agent-configs/<agent>` main.
+
+Always prints the diff first. `--from forge` resets the local checkout to forge main (effective on the next deploy); `--from local` is not supported yet. With no `--from`, prompts for the direction.
+
+**Usage:** `hivectl forge reconcile-config [OPTIONS] <AGENT>`
+
+###### **Arguments:**
+
+* `<AGENT>` — Agent whose config branches to reconcile
+
+###### **Options:**
+
+* `--from <FROM>` — Which side to reconcile from. Omit to be prompted after the diff
+
+  Possible values:
+  - `forge`:
+    Reset the local applied checkout to forge main
+  - `local`:
+    Advance forge main from local — not supported yet
+
+* `--verbose` — Include the full diff (not just `--stat`) in the report
+
+
+
 ## `hivectl matrix`
 
 matrix-tuwunel user provisioning.