Reconcile external_directory and pass every declaration to the reconciler

[chubes4]

Closes #316.

Fresh installs go through runtime_generate_config. Every existing install goes through _runtime_repair_opencode_json_additive instead — and that path only reconciled permission.edit. So the upgrade path silently diverged from a fresh install in two ways:

1. Stale workspace grant. An engineering→managed upgrade kept "/var/lib/datamachine/workspace/**": "allow" — a grant to a directory that is empty by design on managed. That is exactly the drift #314 set out to eliminate; I removed it by hand on h44 at the time rather than fixing the cause.

2. New declarations never arrived. --managed-writable and --log-path were added to the Python helper's argparse but never passed from bash. Applying the first real log grant to h44 produced:

--- external_directory ---
                              ← empty
--- edit ---
  wp-admin/**: deny
  ...                         ← no /var/log entries either

The flags were accepted, recorded as options, reflected in AGENTS.md, and had no effect on the permission set.

Fix

expected_external_directory owns the managed grants the same way expected_edit_permission owns the edit rules:

• absolute and ~ paths are wp-coding-agents' to write and remove
• relative entries are operator-added and preserved
• the workspace dir arrives via --workspace-dir, so the reconciler adds it under engineering and drops it under managed

And the bash callers now pass --managed-writable, --log-path, and --workspace-dir alongside --managed-source.

Tests

tests/posture.sh covers the reconcile path specifically — stale workspace grant dropped, operator-added grant preserved, and a log path naming a file granted as a literal rather than only as a subtree.

That last one matters: /var/log/php8.5-fpm.log/** matches nothing, which is why #325 emits both forms.

Full suite: no new failures (same 7 pre-existing environment failures as main).