feat: gr2 apply converges partially-materialized units with missing nested repo checkouts

[laynepenney]

Summary

gr2 apply still has a false-noop case when a unit already exists at the correct path with unit.toml, but one or more declared repos under unit.repos have not actually been cloned into the unit workspace.

Today planning can emit no operation for that state, because ExecutionPlan::from_workspace_spec() only notices missing unit.toml, non-default unit path, or missing links. The nested repo checkouts are only created when some other op happens to call materialization.

Why this matters

• replay/idempotence is incomplete
• migration/cutover will hit this exact state often
• gr2 apply should converge declared repo attachments, not only missing units

Acceptance

• planning emits an operation when declared unit repos are missing even if unit.toml and unit path are already correct
• apply clones/converges the missing nested repo checkouts idempotently
• regression test covers: existing unit at correct path + missing repo checkout -> non-empty plan + successful apply
• implementation uses the shared Phase 1 contract artifact from premium#594 once available

Related

• grip#514
• grip#522
• premium#594