feat(cloud-sync): Runtime Sync tab, per-repo sync coverage, Channels-first sidebar

[sudomaggie]

Summary

Adds a Sync tab to Runtime → cloud org (same content as org management → Sync), plus a Session coverage section on that shared tab showing one row per repo with the share of sessions synced to the org. Also moves cloud Channels above Team Sessions in the sidebar.

Problem

• Sync diagnostics (last-sync, manual trigger, connection health, journal) existed only in org management — Runtime users had to leave the surface to check whether sync worked.
• Nothing answered "how much of my work in this repo is in this org?" A repo could be mostly unpushed with no way to notice.
• Channels rendered below the unbounded Team Sessions list, so they got pushed off-screen.

Solution

One shared tab. New CloudOrgSyncTab wires useCloudOrgSyncStatus to CloudOrgSyncSection; both surfaces mount it, so they can't drift. Probes now fire when the tab opens rather than on every panel mount.

Per-repo coverage. New pure module org2CloudSyncCoverage.ts renders one row per org repo scope — scope string, synced/syncable, meter, percentage — with totals in the section title. Sessions resolve through the same path the push pass uses (getSessionScopeKeys → peekMatchingOrgRepoScope), so rows carry the exact scope string the engine pushes as repoScopeKey. Sessions outside every org scope are excluded from rows and totals, so the percentage means "of the work this org can receive."

Denominators reuse the engine's own filters — isPrimarySessionListSession (drops subagents/workers) and isCloudPushCandidate (drops teammate copies). Numerator is the durable push marker, so counts survive restarts.

Also: manual-sync outcome note moved left of the primary button. i18n across all 13 locales.

Sidebar (separate commit, unrelated): Channels lead Team Sessions; merge extracted to mergeCloudSidebarSections for test coverage.

Potential risks

• Coverage is local evidence, not a server read — sessions pushed from another machine aren't counted; clearing local storage resets it until the next pass.
• Rows depend on async scope-key resolution; the section can be briefly sparse on a cold cache (hook subscribes via useShareableScopeKeyVersion).
• An unhydrated repo-scope mirror shows the empty state rather than a wrong number — deliberate, but looks empty for a moment after launch.
• The tab now subscribes to sessionsAtom (hot); O(sessions) per change while open.
• Sidebar reorder is a visible behavior change. Neither change was exercised against a live app.

Validation / Test plan

• tsc --noEmit clean · eslint clean, no new suppressions
• 1213 tests / 133 files pass across Org2Cloud/, CloudOrgPanelView/, dataSource/
• 84 tests / 14 files pass across WorkstationSidebarConnector/
• New: 18 coverage unit tests (grouping, org-scope-only, in-flight skip, ordering, rounding), section-render tests (rows, empty state, bar edges, note/button order), hook tests through the real resolver, Runtime tab-switch test, sidebar ordering test

Manual before merge: open Runtime → cloud org → Sync wit