feat: add --pull-only to conf_sync, wire into intermediate orchestrator

Partner conf cache (/tmp/.vv/) was only refreshed at array start. If a partner
updated their conf mid-day, this host's RAM cache went stale until next reboot.
Intermediate orchestrator now pulls partner confs every 4 hours as step 1.

conf_sync.sh --pull-only: pulls partner confs into local cache, skips push
(push is already handled by conf_populate.sh --push-only on conf save).

System_Essentials/conf_sync.sh

@@ -27,6 +27,7 @@
 #
 #   conf_sync.sh                   Full sync: pull from all partners + push to all partners
 #   conf_sync.sh --push-only       Push own conf to all partners (fast, for conf-save hook)
+#   conf_sync.sh --pull-only       Pull partner confs into local cache only (for intermediate orch)
 #   conf_sync.sh --dry-run         Show what would happen, no changes
 #   conf_sync.sh --log             Verbose output
 #
@@ -36,10 +37,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../load_config.sh"
 
 PUSH_ONLY=false
+PULL_ONLY=false
 FILTERED_ARGS=()
 for arg in "$@"; do
     case "$arg" in
         --push-only) PUSH_ONLY=true ;;
+        --pull-only) PULL_ONLY=true ;;
         *)           FILTERED_ARGS+=("$arg") ;;
     esac
 done
@@ -58,7 +61,7 @@ if [[ "$DRY_RUN" == false ]]; then
 fi
 
 # ── Copy own conf into local cache ───────────────────────────────────────────
-if [[ "$PUSH_ONLY" == false ]]; then
+if [[ "$PUSH_ONLY" == false ]] && [[ "$PULL_ONLY" == false ]]; then
     if [[ -f "$MY_CONF" ]]; then
         if [[ "$DRY_RUN" == true ]]; then
             warn "DRY RUN — would copy $(basename "$MY_CONF") → $CACHE_DIR/"
@@ -108,6 +111,10 @@ for host_var in $(compgen -v | grep -E '^HOST[0-9]+$' | sort); do
     fi
 
     # ── Push: send own conf to partner's /tmp/.vv/ cache ────────────────────
+    if [[ "$PULL_ONLY" == true ]]; then
+        continue
+    fi
+
     if [[ "$DRY_RUN" == true ]]; then
         warn "DRY RUN — would push ${MY_ID,,}.conf → $partner_host:/tmp/.vv/config/cached/.confs/"
         continue
@@ -133,6 +140,8 @@ done
 # ── Summary ───────────────────────────────────────────────────────────────────
 if [[ "$PUSH_ONLY" == true ]]; then
     info "Conf push complete — pushed to $PUSHED host(s)${FAILED:+, $FAILED failed}"
+elif [[ "$PULL_ONLY" == true ]]; then
+    info "Conf pull complete — pulled $PULLED partner conf(s)${FAILED:+, $FAILED failed}"
 else
     info "Conf sync complete — pulled $PULLED, pushed $PUSHED${FAILED:+, $FAILED failed}"
 fi