One sync_service primitive in auto-discover

[FAZuH]

Parent

#24 — Spec: One typed seam through which all NAT state flows

What to build

The apply-a-mapping flow in auto-discover is implemented once instead of twice. A single sync_service(target, resolved) primitive absorbs the resolve-port → policy-route → mapping → register steps for both container and local targets (target is an enum parameterizing where the two currently diverge). Both the sync command path and the container-event path call the same primitive; the duplicate service-matching and registration logic between the two entry points is removed. The port-decision step sits behind an internal seam so a later port-authority change can swap it without touching callers. Behavior is unchanged from the operator's perspective.

Acceptance criteria

• One sync_service(target, resolved) primitive handles both container and local targets; sync_docker/sync_local duplication is removed
• The sync command path and the container-event path both call the primitive; duplicated service-matching logic is gone
• The port-decision step is behind an internal seam (one place to swap later), not inlined in callers
• sync_service is unit-tested with in-memory natmap and Consul adapters, covering docker and local targets and both entry points
• Full workspace builds and all existing unit tests pass

Blocked by

• Typed natmap client with honest vocabulary #25 — Typed natmap client with honest vocabulary