Fix CLI preview safety and resource idempotency

[vwall]

Summary

Fix six correctness issues found during repository review:

• Reject unexpected apply arguments before planning so trailing --dry-run cannot be silently ignored.
• Reject overlapping copy paths, including case-insensitive aliases, before mutation.
• Allow directory replacement when a nested target has an incompatible type.
• Preserve macOS defaults string whitespace and repair stored type mismatches.
• Require a managed Git path to be the worktree root.
• Keep repeated init --agents updates byte-idempotent.

Includes regression tests and updated resource documentation.

Verification

• make fmt-check
• go test ./...
• go vet ./...
• git diff --check
• Distribution smoke test using a freshly built temporary binary
• Real macOS defaults verification against a temporary plist: type repair, whitespace preservation, and subsequent satisfied status

Local login-shell smoke coverage was skipped because the host could not report UserShell. Tests and vet used a temporary Go cache due to sandbox restrictions on the default cache.

Safety

• Status and dry-run remain read-only.
• Apply remains idempotent.
• Risky changes require explicit configuration and confirmation.
• No secrets or private machine details are included.

Documentation

• Resource documentation updated for copy overlap rejection, typed defaults comparisons, and repository root verification.