[codex] Fix VPS state sync allowlist

[JohnyNoxwell]

Summary

• Add Stage 7B.1 and correct local VPS state sync to push only an explicit runtime-state allowlist from the checkout root.
• Preserve pull exports/logs behavior while preventing config, sessions, SQLite databases, source code, .git, docs, tests, deploy, virtualenvs, build artifacts, scratch, locks, and unknown root files from accidental push/pull paths.
• Strengthen Docker ignore rules and update the Russian VPS deployment guide.

Checks

• sh -n deploy/local/tg-state-sync.sh
• git diff --check
• make verify
• make pre-commit
• docker info: Docker daemon unavailable, so Docker build/Compose checks were not run.