fix: prevent recursive .bak trees during gstack upgrade

[aylint]

Summary

Fixes a /gstack-upgrade bug that could create recursive backup trees during repeated upgrades.

The issue had two paths:

• The upgrade flow copied the primary install into a vendored copy without excluding .bak*
• Git-based installs could keep old top-level .bak* directories around because git reset --hard does not remove untracked backup dirs

What Changed

• Purge top-level .bak* after git reset --hard
• Replace vendored sync cp -Rf with rsync, excluding .git and .bak*
• Scrub any leftover top-level .bak* after vendored sync
• Add a regression test covering the generated upgrade instructions

Validation

Ran:

• bun run gen:skill-docs
• bun run skill:check
• bun test
• bun test test/gen-skill-docs.test.ts

Notes:

• The upgrade fix itself is clean and scoped to 3 files
• Some repo-wide failures are already present on origin/main and are not caused by this PR:
  • bun run skill:check fails because multi-host generated skill trees are stale upstream
  • test/host-config.test.ts has stale/missing golden-host outputs upstream
  • test/team-mode.test.ts times out upstream
  • browse/test/commands.test.ts and browse/test/snapshot.test.ts fail with EADDRINUSE upstream in this environment

User Impact

/gstack-upgrade no longer copies backup trees into vendored installs. Git-based upgrades now clear stale top-level .bak* directories, and vendored sync excludes .bak* to prevent backups from recursing during repeated upgrades.