[Phase 2] Make cage diff and sync binary-safe (restore lost binary artifact fix)

[Saber5656]

Background

A bug issue filed against the previous repository on 2026-06-27 (Vault record TSK-1325, CAGE-BUG-005) was lost when the public repository was recreated, so the current issue set does not carry it.

Binary artifacts produced in the sandbox cannot be synced: diffs are extracted with plain git diff (no --binary), so git apply fails with cannot apply binary patch to '<file>' without full index line. The legacy extraction sites are cage-demo/src/sync/diff.rs:163-171 and 192-200. FR-3 (artifact sync) does not restrict artifacts to text, so this is a functional gap, not an edge case.

Scope

• Extract diffs with git diff --binary so patches carry full index data for binary files.
• Apply binary patches through the existing git apply path while keeping hooks-path and traversal validation unchanged.
• In previews, show binary changes as a summary line (e.g. Binary file changed (1.2 MiB)) instead of hunks; approval stays file-level.
• Add a size warning threshold for very large binary artifacts (relates to THREAT-AS-D-01 / THREAT-CE-D-02 and the warnings in [Phase 2] Implement sync include/exclude filters and sensitive file warnings #17).
• Quoted/space-containing path parsing is tracked separately in [Phase 2] Safely display sandbox changes with cage diff #14; keep this issue about binary content.

Acceptance Criteria

• A binary file added, modified, or deleted in the sandbox can be approved and synced to the host.
• Text-only diff and sync behavior is unchanged (existing tests pass).
• Previews present binary changes without dumping raw content.
• Oversized binary artifacts trigger a warning before approval.

References

• Vault: 01-Projects/Cage/TSK-1325 (lost issue: "cage sync cannot apply binary file changes because diffs are extracted without --binary")
• cage-demo/src/sync/diff.rs extraction and recovery paths
• cage-demo/docs/PRD.md FR-3.2, FR-3.3, FR-3.4
• [Phase 2] Safely display sandbox changes with cage diff #14, [Phase 2] Implement cage sync approval flow and safe patch application #15, [Phase 2] Implement sync include/exclude filters and sensitive file warnings #17