feat: relationship model (requires/repos/predicates) + git sync

A derived, mostly-computed model of how programs, deployments, and repos relate,
plus the git-sync surfaces that motivated it. See docs/relationships.md.

Core:
- `requires: [{kind, ref, version?, bind?}]` on programs + deployments — one
  precondition relation; `system_dependencies` is its `{kind: system}` alias.
  kind fixes meaning + check (system=installed, deployment=exists).
- relations.py: derives repos (git toplevel / monorepo), fan-in, and the
  predicates functional?/fresh?/deployed? — nothing stored.
- env is generated FROM a `{kind: deployment, bind}` requirement (target URL →
  consumer env), never scraped back into one; explicit defaults.env still wins.
- git.py: working-copy status/pull, repo toplevel + remote url.

Surfaces:
- `castle graph` + GET /graph — the relationship diagnostic.
- GET /repos, /repos/{key}/git|sync — repo-scoped sync (a repo is the sync unit;
  a monorepo backs several programs). GET /programs/{name}/git|sync + repo context.
- Dashboard: Graph screen, program-page git status + repo-aware Sync, and a
  monorepo banner on Programs.

Governing principle: predicates are derived; encode only the non-derivable, as a
node or edge property. Pull-only sync — converge stays a separate step.

cli/src/castle_cli/main.py

@@ -193,6 +193,12 @@ def build_parser() -> argparse.ArgumentParser:
         "doctor", help="Diagnose setup + runtime health, with next-step hints"
     )
 
+    # Relationship model — repos, requires edges, and derived status.
+    p = subparsers.add_parser(
+        "graph", help="Show how programs/deployments relate (repos, requires, status)"
+    )
+    p.add_argument("--json", action="store_true", help="Output as JSON")
+
     # Cross-resource overview
     p = subparsers.add_parser("list", help="List programs, services, jobs, and tools")
     p.add_argument(
@@ -335,6 +341,10 @@ def main() -> int:
         from castle_cli.commands.doctor import run_doctor
 
         return run_doctor(args)
+    if cmd == "graph":
+        from castle_cli.commands.graph import run_graph
+
+        return run_graph(args)
     if cmd == "list":
         from castle_cli.commands.list_cmd import run_list