feat: Phase 2 — Read/Adopt (ct adopt) + state file

[2000game]

Phase 2 — Read/Adopt (ct adopt) + state file. Bring existing structure under management, selectively.

Part of #1.

Scope

• State file format (JSON): logical key → CT ID + last-known state, only for managed resources. Stored in ct-structure (Git) for now.
• ct adopt <type> <id|filter> — put one existing resource under management; write it into config + state. No full "slurp everything" import.
• ct import --dry-run — preview the config entry an adopt would generate.
• Managed-guard: the tool only ever touches resources present in state. Unmanaged groups stay untouched, never shown, never proposed for deletion.

Definition of done

• Adopt one real campus + one leadership group; state file + generated config entries are correct.
• Re-running adopt is idempotent (no duplicate state entries).
• A resource not in state is provably invisible to the tool.

[2000game]

Done — merged in #10 (ct adopt + JSON state file). DoD met: adopt writes state + generated config entry, idempotent via upsert (no duplicate entries), and the managed-guard keeps unmanaged resources invisible to plan/apply. Live-verified against a real campus.