Add an archcore globals pull command with a lockfile

[ivklgn]

Problem

Mounted global sources have no lifecycle command — there's no supported way to fetch or refresh them, and no lockfile pins what was fetched. (Health reporting already exists in status/doctor; only fetch/refresh is missing.) The source of a "pull" (git, URL, path) is not yet defined.

Expected result

An archcore globals command group starting with globals pull that refreshes declared sources into their mount points and records a lockfile, while respecting the read-only-everywhere invariant.

Impact

Completes the globals lifecycle so shared/org-wide context can be updated in a controlled, reproducible way.

Scope

• Agree the globals command surface and the pull source model (design note).
• Implement globals pull to refresh declared sources.
• Write a lockfile pinning the fetched state of each source.
• Respect the read-only-everywhere invariant.
• Tests with a fixture source.

Files: cmd/globals.go (new) + tests, registered in cmd/root.go

Acceptance: archcore globals pull refreshes mounted sources and records a lockfile without violating read-only rules.

Status: needs design on the command surface and the pull source model.

[ivklgn]

Re-checked against v0.7.0: still open, and the pressure went up rather than down.

.archcore/globals/global-sources.spec.md records distribution and lifecycle — clone, submodule, archcore globals pull, lockfiles — as deferred with no accepted approach, and names in-tree vendoring as the interim answer.

.archcore/globals/globals-are-mandatory.adr.md sharpens it: every declared global is mandatory, so there is no "tolerate missing" mode. A source that is not on disk stops the server from starting. That turns "how does the source get here" into a first-run blocker rather than a convenience.

No cmd/globals.go exists. The scope in this issue is unchanged.