feat(depot): select a depot tree on disk with --out DIR

`depot status` and `depot get` chose a local depot tree with `--target
local`, resolving the root from `DEPOT_DIR`. That split one decision over
two flags and left `--target local` valid with no directory anywhere.

Adopt the nwsync convention instead: `--out DIR` names the tree on disk in
the same breath as choosing it, and `--target` now names remote backends
only. The two are mutually exclusive. `--target local` stays as a
deprecated alias for `--out $DEPOT_DIR` so existing callers keep working,
and `status --source` is now ignored with a warning instead of silently
accepted.

Also split positionals off by hand in `depot get`, so the documented
`depot get <sha> <dest> --out DIR` form parses its flags at all — Go's
flag package stops at the first positional.

Closes #66

docs/command-surface.md

@@ -29,9 +29,15 @@ aliases.
 | `assets` | `fix-mdl` | Lowercase `.mdl` names and rewrite model identity to match. |
 | `assets` | `check-dupes` | Report runtime-name (basename) collisions across dirs. |
 | `assets` | `clean-dupes` | Delete clean-tree files whose basename collides with primary. |
+| `depot` | `status` | Report referenced-vs-present drift against a backend. |
+| `depot` | `push` | Upload referenced-but-absent blobs from a local depot. |
+| `depot` | `verify` | Existence sweep plus sampled download re-hash. |
+| `depot` | `get` | Fetch one blob with sha re-verify. |
+| `depot` | `pull` | Incremental verified pull of every referenced blob. |
 
-`crucible-depot` remains registered but unwired. It fails closed with exit `70`
-and never emits placeholder artifacts.
+`depot status` and `depot get` pick their backend either with `--out DIR`, a
+depot tree on disk, or with `--target bunny|cdn`, a remote backend. The two
+flags are mutually exclusive.
 
 ## Hidden compatibility aliases
 
@@ -49,6 +55,7 @@ but omitted from routine help and the interactive menu:
 | `topdata` | `build-top-package` | `build-top-package` |
 | `topdata` | `compare-topdata` | `compare-topdata` |
 | `topdata` | `convert-topdata` | `convert-topdata` |
+| `depot` | `--target local` | `--out $DEPOT_DIR` on `status`/`get` |
 | `wiki` | `build-wiki` | `build-wiki` |
 | `wiki` | `deploy-wiki` | `deploy-wiki` |