Sync builder workspaces from managed repo

agent_builder/builder.py

@@ -117,6 +117,13 @@ Your tools:
                                     elsewhere; use force=True only after
                                     the user explicitly accepts replacing
                                     the current repo source.
+  - sync_agent_workspace_from_repo(name)
+                                  — replace agents/<name>/ in MinIO with
+                                    the current managed repo source and
+                                    record its repo base marker. Use this
+                                    before editing an existing deployed
+                                    agent, or when deploy reports
+                                    workspace_untracked/workspace_drift.
   - cp_refresh_agent(name)        — force the control plane to re-fetch
                                     the agent's live card after an
                                     out-of-band redeploy
@@ -149,9 +156,10 @@ Discipline:
   - When deploying, return the URL the platform gave back to the user so
     they can curl it / share it.
   - If cp_deploy_tarball returns workspace_drift or workspace_untracked,
-    stop and report that the builder workspace is stale. Do not use
-    force=True unless the user explicitly says to overwrite the managed
-    repo with the current MinIO files.
+    use sync_agent_workspace_from_repo when the user wants the builder to
+    continue from the current repo. Do not use force=True unless the user
+    explicitly says to overwrite the managed repo with the current MinIO
+    files.
   - After cp_deploy_tarball returns, compare ``live_skills[].input_schema``
     with the skill signatures you wrote. If an argument is missing from the
     live schema, treat the deploy as failed, fix the source/schema version,