When mkdir -p creates multiple nested dirs at once, only the first
level got a watcher. Now syncCreate walks all subdirectories and
adds watchers for them. The event handler already filters ignored paths.

- touch fires CREATE then CHMOD, the CHMOD was overwriting CREATE
  in the debounce map, and CHMOD is not handled, so file was never synced
- Now debounce merges event ops (CREATE|CHMOD → treated as CREATE)
- Added sync/remove debug logging
- Tested in Docker: create, modify, delete all working

- log.go: log level system (DEBUG, INFO, WARN, ERROR, NONE)
- CLI: -log-level flag (default info), -verbose as shorthand for debug
- Watcher: logs sync/remove actions at INFO level
- Watcher: logs events at DEBUG level
- Errors: structured error messages (DISK FULL, PERMISSION DENIED, etc.)
- Updated README with -log-level flag

- errors.go: retry wrapper for transient errors (ENOENT),
  structured error logging (disk full, permission denied, symlink loops)
- sync.go: continue on individual file errors, log clearly, skip broken
  symlinks instead of failing entire sync
- watcher.go: log all errors with context, handle readlink failures
- Added 11 tests for error handling scenarios
- 50 tests passing

- syncCreate: remove existing file before creating symlink
- syncWrite: handle symlink target changes (remove + recreate)
- Added 4 new tests:
  - CreateSymlink: new symlink synced to /data
  - UpdateSymlinkTarget: symlink target change updates /data
  - RemoveSymlink: symlink removal synced
  - ModifySymlinkTargetFile: target file change preserves symlink
- 39 tests passing

- Fixed directory pattern matching: go-gitignore doesn't match 'build/'
  against bare 'build', now checks with trailing slash appended
- Added ModTime to FileMeta for reliable change detection (same-size
  file modifications now sync correctly)
- Updated Dockerfile to golang:1.24-alpine (was 1.22)
- Downgraded go.mod to Go 1.24 (system has custom 1.26.4 build)

Docker tested with podman:
- Initial sync correctly excludes ignored dirs/files
- Nested .gitignore works (sub/ ignores *.tmp)
- Watcher syncs new/modified/deleted files
- Case-sensitive rename (Foo→foo) handled correctly
- Same-size file modifications sync correctly

- Replaced go-gitignore with custom GitignoreStack that tracks
  multiple .gitignore files hierarchically
- Patterns are processed in root-to-leaf order, last match wins
- Negation patterns in child dirs override parent ignores
- Patterns only apply within their directory scope (no leaking)
- Added 6 new tests for nested .gitignore:
  - Scoped: patterns only affect own directory
  - Dir-scoped: different dirs can ignore different things
  - Negation override: child !pattern un-ignores parent's *.pattern
  - Deep nesting: 3+ levels of .gitignore
  - Parent scope doesn't leak to siblings
- All 35 tests passing

- Added watcher_test.go: 10 tests covering create, write, remove,
  rename, ignored files, debouncing, directory creation/removal,
  and manifest updates
- Refactored watch() to accept context.Context for clean cancellation
- Added signal handling (SIGINT/SIGTERM) for graceful shutdown in main.go
- Fixed test expectations (version two = 11 bytes, not 10)

- main.go: CLI entry point with flag parsing
- gitignore.go: .gitignore loading and parsing
- sync.go: initial sync with manifest tracking
- watcher.go: fsnotify-based file watcher with debouncing
- Dockerfile: multi-stage build for Alpine runtime