Split services/sync_service.py — exceeds 1500 LOC hard ceiling (now ~3.4k)

[ottomansky]

Context

src/keboola_agent_cli/services/sync_service.py is ~3,419 LOC, well over the CONTRIBUTING.md services hard ceiling of 1,500 LOC. The ceiling was already breached on main (~2,767 LOC before #360); #360 added the fresh-CREATE variable-link backfill (+~650 LOC) and surfaced this during review (NB-2).

Per CONTRIBUTING.md "File-size budgets", a split is required before more functionality lands in this file. Tracked here so the deferral is not orphaned (linked from #360).

Proposed extraction

The variable-link backfill is a cohesive, low-coupling subsystem and a natural first extraction:

• _resolve_variable_bindings, _resolve_variables_parent, _resolve_variables_row, _apply_variable_binding
• supporting dataclasses WritebackResult, CreatedConfig, VariableBindingResult, LocalConfigHashes

Candidate: move into services/sync_variable_binding.py (free functions taking the client/manifest, or a small mixin/helper class), keeping SyncService.push() as the orchestrator. Other cohesive groups (diff building, branch-path resolution, manifest writeback) are further extraction candidates.

Acceptance

• wc -l of every services/sync_*.py under the ceiling (or a documented, justified exception)
• no behavior change; existing tests/test_sync_*.py + E2E green
• public SyncService surface unchanged

Refs

• PR fix(sync push): resolve variable bindings + row values on fresh CREATE; --branch promotes default tree #360 (introduced the backfill; review finding NB-2)