feat: M4 gossip ops and UX

Refs #1

- /v1/diff endpoint returns each node's fingerprint set + tombstoned
  auto-thread status
- knox gossip diff <peer-url>: shows peer-only/local-only fingerprints
  (pull/keep preview) and tombstone divergence (resolved-on-peer vs
  would-resurrect)
- knox gossip sync: one-shot anti-entropy sweep + reconcile
- gossip server starts before initial seed so peers can reach a booting
  node; KNOX_PEER_ADDR alone now serves without KNOX_PEERS
- integration tests for diff + tombstone reporting
- e2e verified: two live daemons, diff previewed 1655 peer-only fps,
  sync converged second node to 1655 observations

docs/gossip-protocol.md

@@ -234,9 +234,13 @@ converge to identical logs after a bidirectional sweep (integration test
 `internal/watch/gossip_test.go`); second sweep is idempotent; `time.Now()`-free
 fact paths confirmed by grep.
 
-**M4 — Ops & UX.** `knox gossip` subcommand (status/diff), reconcile-on-pull,
-tombstoned thread handling in diff output, logging, config (env `KNOX_PEER_ADDR`,
-`KNOX_PEERS`).
+**M4 — Ops & UX.** DONE. `knox gossip` subcommand: `status`, `diff <peer-url>`
+(observation fingerprint divergence + tombstoned auto-thread detection), and
+`sync` (one-shot sweep + reconcile). `/v1/diff` endpoint serves each node's
+knowledge summary. Gossip server starts immediately (before seed) so peers can
+reach a booting node. Config via env `KNOX_PEER_ADDR` / `KNOX_PEERS`.
+Verified e2e: two daemons, `diff` previewed 1655 peer-only fingerprints, `sync`
+pulled all and converged B to 1655 observations.
 
 ## 9. Future Work (explicitly out of M1–M4)