fix(sync): stop rewriting keep.lock on every sync

[cvince]

Problem

Running bare capy (sync) rewrites keep.lock on every run — even when .env is empty and nothing has changed. This produces a spurious git diff after every sync.

Root cause

During sync, the self-heal step compares the local keep.lock against the server's keep_file and overwrites local on any difference:

const localSerialized = currentKeep ? JSON.stringify(currentKeep) : '';
const serverSerialized = JSON.stringify(serverKeep);
if (localSerialized !== serverSerialized) { /* rewrite keep.lock */ }

But the two sides are never in the same shape:

• Local is read off disk via readKeepFile() (raw as KeepFile), so it still carries the injected _comment field and is already key-sorted.
• Server keep_file has neither _comment nor guaranteed ordering.

So JSON.stringify(local) !== JSON.stringify(server) is always true → writeKeepFile() fires on every sync, independent of .env contents.

Fix

• Extract the canonical lockfile serialization into an exported serializeKeep() — the single source of truth for the on-disk form (_comment, fixed key order, sorted variables, stable per-entry field order). The self-heal comparison now normalizes both sides through it, so it only rewrites on a real change.
• Give writeKeepFile() a no-op guard: if the on-disk file is already byte-identical to the canonical output, skip the write entirely. Defense-in-depth that also stops churn from other writeKeepFile callers.

Tests

tests/files/fileManager.test.ts:

• serializeKeep canonical comparison (sync self-heal) — asserts an on-disk keep (with _comment) and a server keep (without) serialize identically (the fix), and documents that the old bare-JSON.stringify comparison saw them as different (the bug). Plus order/extra-field independence and a positive test that a real value_hash change is still detected.
• writeKeepFile no-op guard — skips the write when on-disk content already matches; rewrites when it differs.

All affected suites pass individually (fileManager, capyCommand, branchKeepFile); tsc --noEmit clean.