Phase A reconciler — shares/users/groups, dry-run default (#57)

[ChrisonSimtian]

The IaC vertical on top of the SSH-runner (transport wedge, #3). Per the write-path plan, Phase A.

What

• Tools/ — SynoShareTool / SynoUserTool / SynoGroupTool: typed --enum reads + command builders that encode each tool's positional argv once (DSM 7.1). Shared EnumOutput parser (names = non-colon lines after the Listed: header — verified live).
• Provisioning/ — Share/User/GroupSpec + SynologyDesiredState; SynologyReconciler: PlanAsync diffs desired vs live, ApplyAsync runs. Output is a SynologyPlan of create/delete/skip actions, each carrying its command + reason.
  • Dry-run by default (like Deploy-Shape.ps1) — ApplyAsync(apply:false) mutates nothing.
  • Never prunes unmanaged resources — deletes only when a spec sets present:false.
  • Passwordless user-create is BLOCKED with a clear reason (can't synouser --add without a password).
• CLI — plan <spec.json> (read-only diff), apply <spec.json> [--confirm] (dry-run unless --confirm).
• Tests — 5 reconciler tests over a scripted ISshRunner (no NAS needed).

Verification (live NAS, 2026-05-31, zero mutation)

synosharp plan against a mixed spec:

= skip   group users  (already present)
+ create group synosharp-demo  (absent → create)
      $ synogroup --add synosharp-demo
= skip   user homelab  (already present)
= skip   user svc-no-pw  (BLOCKED: create needs a Password)
= skip   share Volume-1  (already present)
+ create share synosharp-test  (absent → create)
      $ synoshare --add synosharp-test 'demo share' /volume1/synosharp-test '' '' '' 1 0
2 change(s) to apply.

Not in this PR

A real apply --confirm against the live box (would create/delete) — deferred to an explicit reversible smoke test. Field-level drift (desc/ACLs) and NFS (synowebapi, on Virtual DSM) are later phases.

🤖 Generated with Claude Code