Improve copy performance and reject conflicting configuration

[vwall]

Summary

Copy status repeatedly traversed nested subtrees and loaded whole files into memory. It now visits each directory tree once, compares file sizes before reading bounded chunks, and streams file copies. Small files use smaller buffers.

Configuration now rejects extra YAML documents (including malformed or empty trailing documents) and exact normalized target collisions among repositories, copies, symlinks/groups, SSH private/public keys, and asdf tool-version files. Directory prerequisites and parent/child targets remain allowed. Ownership checks are lexical; filesystem aliases and overlapping directory contents are outside their scope.

Includes behavioral regressions, reusable nested/large-file benchmarks, and updated docs.

Performance evidence

Local synthetic measurements used the same temporary benchmark before/after, three iterations per case; these are not production latency guarantees.

Fixture	Before	After
One identical 4 KiB file under 12 nested directories: status time	327 ms	0.73 ms
Same nested fixture: allocated bytes per check	81.6 MB	110 KB
One identical 16 MiB file: allocated bytes per status check	33.6 MB	83 KB
Flat 4 KiB file: allocated bytes per status check	34.6 KB	34.5 KB

Permanent benchmarks: go test ./internal/resources -run '^$' -bench 'BenchmarkCopy' -benchmem.

Verification

• make release-check (formatting, full tests, vet, build, distribution smoke test)
• git diff --check
• Built CLI rejected conflicting targets and malformed trailing YAML with exit 2 and valid JSON before mutation
• Regression tests cover chunk boundaries, file mismatches, permission preservation, existing copy protections, YAML document boundaries, and cross-resource collisions
• Independent review of the combined diff

The local login-shell smoke check was skipped because the host could not report UserShell. Go checks used a writable temporary cache due to sandbox restrictions.

Safety

• Status and dry-run remain read-only.
• Apply remains idempotent; copy overlap/symlink protections remain in place.
• Risky changes still require explicit configuration and confirmation.
• No secrets or private machine details are included.

Documentation

• Config and copy resource documentation updated.

Separate follow-ups: #6 (subprocess inspections) and #7 (bounded log capture).