fix: add vcs_op_push / vcs_op_pull to build agent permission and document sync workflow

[alpibrupa]

Problem

vcs_op_push and vcs_op_pull exist as tools but are not in any agent's permission allowlist. No agent can sync with a remote lex-vcs server. The tools are dead code from the agent's perspective.

Fix

• Add "vcs_op_push" and "vcs_op_pull" to build_permission() in rules.lex (or create a dedicated sync_permission() if we want tighter control)
• Update the build agent's system prompt to document the sync workflow: pull before starting, push after a successful lex ci
• Verify vcs_op_push dry_run mode works and document it as the safe way to preview

Acceptance

• Build agent can call vcs_op_push and vcs_op_pull
• lex check --strict src/ passes