refactor(sync): cloud sync classifies skipped legs by a typed refusal kind (T13315)

[kryptobaseddev]

Task: T13315

Stacked on #1968 (feat/T13256-idle-no-pingpong). This is review-hotfix's non-blocking nit on #1962.

Change

• Push results: PushStreamReport.refusedKind is one of schema-missing, push-off, no-genesis, genesis-pending or store-behind. Every refusal site sets it.
• Pull results: PullStreamReport.refusedKind is pull-off or segment.
• classifySyncLegs(push, pull) is exported with TSDoc and sits in cloud/nexus-vault.ts. It works out skipped, refused, disabled and pull-skipped from the kinds alone. SKIP_REASONS, the list of message regexes, is removed. syncOneStream uses the classifier, and its behaviour is otherwise unchanged:
  • disabled means both flags are off;
  • the pull position is shown unless the pull leg was skipped.

Verification

• New tests:
  • reworded skip messages are still skipped, and the stream reports disabled;
  • no-genesis and genesis-pending count as skipped;
  • store-behind and segment count as refused;
  • a message that reads like a skip but has a non-skip kind counts as refused.
• Mutations: 2/2 caught. Dropping no-genesis from the skips fails a test, and so does classifying the pull by its message.
• Test runs: nexus-vault, push and pull pass, 126/126. nexus-vault-cli passes, 37/37.
• Typecheck and lint: core tsc is clean, and biome is clean.
• Gates: 28, 38 (--base), 40, 4 and 32 (--base) pass; lint-changesets passes.

🤖 Generated with Claude Code