Add an archcore globals pull command with a lockfile

[ivklgn]

Problem

Mounted global sources have no lifecycle command — there's no supported way to fetch or refresh them, and no lockfile pins what was fetched. (Health reporting already exists in status/doctor; only fetch/refresh is missing.) The source of a "pull" (git, URL, path) is not yet defined.

Expected result

An archcore globals command group starting with globals pull that refreshes declared sources into their mount points and records a lockfile, while respecting the read-only-everywhere invariant.

Impact

Completes the globals lifecycle so shared/org-wide context can be updated in a controlled, reproducible way.

Scope

• Agree the globals command surface and the pull source model (design note).
• Implement globals pull to refresh declared sources.
• Write a lockfile pinning the fetched state of each source.
• Respect the read-only-everywhere invariant.
• Tests with a fixture source.

Files: cmd/globals.go (new) + tests, registered in cmd/root.go

Acceptance: archcore globals pull refreshes mounted sources and records a lockfile without violating read-only rules.

Status: needs design on the command surface and the pull source model.