feat(shared-vault-sync): add commit-driven auto-push script

push-shared-vault.sh pushes the shared vault only when the worktree is clean
and the local branch is ahead of origin (fetch first); never rebases,
force-pushes, or resolves conflicts. Ships with launchd setup docs. Bump 0.1.2.

Co-Authored-By: Claude <noreply@anthropic.com>

plugins/shared-vault-sync/scripts/push-shared-vault.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# push-shared-vault — commit-driven auto-push for the shared vault.
+#
+# Safe by design:
+#   - pushes only when the worktree is clean (no uncommitted changes),
+#   - pushes only when the local branch is ahead of its remote (fetch first),
+#   - never rebases, force-pushes, or resolves conflicts,
+#   - silently no-ops when offline or when there is nothing to push.
+#
+# Intended to run from launchd or cron at an interval (e.g. every 5 minutes).
+# Requires: SHARED_VAULT_DIR=<path to the shared vault clone>.
+
+set -u
+
+VAULT_DIR="${SHARED_VAULT_DIR:-}"
+LOG="${PUSH_SHARED_VAULT_LOG:-/tmp/shared-vault-push.log}"
+
+[ -n "$VAULT_DIR" ] || exit 0
+
+log() { printf '%s %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" >> "$LOG"; }
+
+git -C "$VAULT_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
+[ -z "$(git -C "$VAULT_DIR" status --porcelain)" ] || exit 0
+git -C "$VAULT_DIR" fetch --quiet origin 2>/dev/null || exit 0
+branch="$(git -C "$VAULT_DIR" rev-parse --abbrev-ref HEAD)" || exit 0
+ahead="$(git -C "$VAULT_DIR" rev-list --count "origin/$branch..HEAD" 2>/dev/null || echo 0)"
+[ "${ahead:-0}" -gt 0 ] || exit 0
+
+if GIT_TERMINAL_PROMPT=0 git -C "$VAULT_DIR" push origin "$branch"; then
+  log "pushed $ahead commit(s) to origin/$branch"
+fi