Managed mode has no supported way to advance a remote-tracking source (pull refused, no drained maintenance window command)

Summary

In managed mode there is no supported way to advance a source that tracks a remote. resolveManagedSyncContext (src/core/persistence/sync-discovery.ts:44) refuses any sync that is not --no-pull:

writer_coordinator_required: Managed sync requires --no-pull; Git pull/rebase needs an explicit drained maintenance window.

gbrain sources pull <id> is refused too, by the filesystem guard ("This file belongs to a managed canonical worktree"), and the autopilot freshness dispatcher still passes pull: true for any source whose config has a remote_url, so that job can only fail. The message names a "drained maintenance window", but 0.51.0.0 ships no command that opens one: sources writer exposes status, claim, activate and transfer only.

Why this matters

A read-only source that follows a remote repository (documentation, decision records, a spec repo someone else owns) is a normal shape: the brain indexes it and never writes to it. Today, after activation, such a source can only be:

• kept as a claimed checkout that nobody can advance — the index silently goes stale; or
• refreshed with sources reclone, which is a full re-clone designed for recovery (it requires a current verified canonical manifest and reserves recovery capacity) and is a lifecycle operation, not a freshness mechanism; or
• archived, losing the capability.

Reproduction (0.51.0.0)

1. Managed brain, activated. gbrain sources add live --path <mirror>/docs claims the worktree.
2. gbrain sources pull live → refused by the filesystem guard.
3. gbrain sync --source live (without --no-pull) → writer_coordinator_required.
4. git -C <mirror> pull --ff-only externally, then gbrain sync --source live --no-pull → imports the changes cleanly, no blockers.

So the import half already works; only the fetch half has no owner.

Expected

Either a coordinated pull (the owner drains, fetches fast-forward only, then syncs), or a first-class read-only remote-tracking source whose freshness the autopilot can maintain.

Retirement condition for our workaround

Until then we either archive the source or leave it frozen; both are capability losses we are tracking as temporary. When this lands, we restore the source and let the autopilot keep it fresh.