feat(#2554): add hivectl forge reconcile-config to reconcile local applied config against forge main

hive-host-sock/src/lib.rs

@@ -51,6 +51,17 @@ pub fn container_name(name: &str) -> String {
     format!("{AGENT_PREFIX}{name}")
 }
 
+/// Which way to reconcile an agent's config branches
+/// ([`HostRequest::ReconcileConfigApply`]).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ReconcileDirection {
+    /// Reset the local applied checkout to forge `main`.
+    Forge,
+    /// Advance forge `main` from local — not supported yet.
+    Local,
+}
+
 /// Requests on the host admin socket.
 ///
 /// Wire format: one JSON object per line.
@@ -200,6 +211,28 @@ pub enum HostRequest {
         #[serde(default)]
         password: Option<String>,
     },
+    /// Report the divergence between agent `agent`'s local applied config
+    /// checkout and its forge `agent-configs/<agent>` `main`. The daemon
+    /// fetches forge `main` read-only and returns a human-readable report
+    /// (ahead/behind counts, commit-range summary, `git diff --stat`, and
+    /// the full diff when `verbose`) in [`HostResponse::messages`]. Read-only
+    /// — never mutates either side. Backs `hivectl forge reconcile-config`
+    /// (the diff it always shows first).
+    ReconcileConfigStatus {
+        agent: String,
+        #[serde(default)]
+        verbose: bool,
+    },
+    /// Reconcile agent `agent`'s config branches in `direction`.
+    /// `Forge` resets the local applied checkout to forge `main` (takes
+    /// effect on the next deploy); `Local` is not supported yet and returns
+    /// an [`HostResponse::error`] (advancing the protected forge `main` from
+    /// local needs lifting branch protection — resolve via a config PR).
+    /// Backs `hivectl forge reconcile-config --from <forge|local>`.
+    ReconcileConfigApply {
+        agent: String,
+        direction: ReconcileDirection,
+    },
     /// Add or update a gateway HTTP-Basic user in the daemon's htpasswd file
     /// (`paths::GATEWAY_HTPASSWD`). Daemon-side equivalent of `hivectl gateway
     /// create-user`: the daemon bcrypt-hashes `password` (cost 12, remapped to