[security/product] sync.py has no encryption awareness — strict-refuse crashes mid-rebase, warning never surfaces

[stancsz]

Severity: High — architect review (2026-06-20).

Encryption was wired into bundle.export (iter-22) but scripts/sync.py has zero awareness of it, even though sync is the command users actually run:

• A SECONDBRAIN_REQUIRE_ENCRYPTION=1 refusal raises EncryptionUnavailable inside export, which sync calls mid-flow — it will crash mid-rebase, leaving the bundle repo in a dirty/rebasing state, rather than failing cleanly before touching git.
• The "N private Concepts exported as PLAINTEXT" warning is emitted by export but never surfaced/aggregated in the sync UX.

A security feature users can't see or safely operate is staged, not shipped.

Acceptance criteria

• sync checks encryption preconditions before starting the git rebase; a strict-mode refusal aborts cleanly with an actionable message and a clean tree.
• The plaintext-private warning is surfaced in sync output.
• Verifier: strict-refuse during sync leaves no partial commit and no rebase-in-progress.