feat: sync shared vault at session start

plugins/shared-vault-sync/hooks/pull-shared-vault.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Pull only the designated shared vault; never block a new agent session.
+set -u
+
+vault_dir="${SHARED_VAULT_DIR:-${PWD:-}}"
+
+emit() {
+  printf '{"continue":true,"suppressOutput":true,"hookSpecificOutput":{"additionalContext":"%s"}}\n' "$1"
+}
+
+if [ ! -f "$vault_dir/AGENTS.md" ] || ! grep -Fq 'This is the shared persistent vault' "$vault_dir/AGENTS.md" || ! git -C "$vault_dir" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  emit 'Shared vault sync skipped: set SHARED_VAULT_DIR or start the session from the shared vault.'
+  exit 0
+fi
+
+if [ -n "$(git -C "$vault_dir" status --porcelain)" ]; then
+  emit 'Shared vault sync skipped: the worktree has local changes.'
+  exit 0
+fi
+
+if GIT_TERMINAL_PROMPT=0 git -C "$vault_dir" pull --ff-only --quiet; then
+  emit 'Shared vault sync completed.'
+else
+  emit 'Shared vault sync failed; run git pull --ff-only from the vault when it is safe to do so.'
+fi