verify(P1): 4-layer verify PASS + ship — sync_to_nova.sh (REQ-229)

L1 structural: bash -n clean, shellcheck 0 warnings.
L2 behavioral: manual gate exits 2 without --release; --list-domains prints
13 ordered domains; rsync exclude list correct; .git protected via filter.
L3 security: no hardcoded secrets; .coverage runtime artifact gitignored.
L4 quality: 8/8 TestSyncToNovaScript tests pass (gate, domain order, exclude
list, consumer-script inclusion, .git filter, conventional regex).

---ci---
project: acdl
phase: 1
milestone: v1.19
status: verify
---/ci---

.gitignore

@@ -40,4 +40,4 @@ metrics/lifecycle/
 *.cer
 *.crt
 *.jks
-*.keystore
+*.keystore.coverage