fix(import[dry-run]) Include provenance tagging in dry-run change detection

why: The dry-run gate only checked added/updated/pruned counts but
omitted provenance_tagged_count, causing "No changes to write" even
when a real run would save provenance tags.  The count was always 0
during dry-run because it was only incremented inside `if not dry_run`.

what:
- Restructure SKIP_UNCHANGED block to count provenance tagging
  regardless of dry_run, while only mutating config when not dry_run
- Add needs_tag check for idempotent counting (only count when the
  tag is actually missing or different)
- Add "[DRY-RUN] Would tag N repositories" report line
- Include provenance_tagged_count in the "Would write to" gate
- Add test_import_dry_run_provenance_tag_shows_write_message

Author: tony

src/vcspull/cli/import_cmd/_common.py

@@ -965,18 +965,28 @@ def _run_import(
             updated_url_count += 1
         elif action == ImportAction.SKIP_UNCHANGED:
             skip_unchanged_count += 1
-            if not dry_run and import_source:
+            if import_source:
                 live = raw_config[repo_workspace_label].get(repo.name)
                 if isinstance(live, dict):
-                    if not isinstance(live.get("metadata"), dict):
-                        live["metadata"] = {}
-                    live.setdefault("metadata", {})["imported_from"] = import_source
-                    provenance_tagged_count += 1
+                    existing_meta = live.get("metadata")
+                    needs_tag = (
+                        not isinstance(existing_meta, dict)
+                        or existing_meta.get("imported_from") != import_source
+                    )
+                    if needs_tag:
+                        if not dry_run:
+                            if not isinstance(existing_meta, dict):
+                                live["metadata"] = {}
+                            live.setdefault("metadata", {})["imported_from"] = (
+                                import_source
+                            )
+                        provenance_tagged_count += 1
                 elif isinstance(live, str):
-                    raw_config[repo_workspace_label][repo.name] = {
-                        "repo": live,
-                        "metadata": {"imported_from": import_source},
-                    }
+                    if not dry_run:
+                        raw_config[repo_workspace_label][repo.name] = {
+                            "repo": live,
+                            "metadata": {"imported_from": import_source},
+                        }
                     provenance_tagged_count += 1
         elif action == ImportAction.SKIP_EXISTING:
             skip_existing_count += 1
@@ -1056,7 +1066,17 @@ def _run_import(
                 "[DRY-RUN] Skipped %s pinned repositories",
                 colors.info(str(skip_pinned_count)),
             )
-        if added_count > 0 or updated_url_count > 0 or pruned_count > 0:
+        if provenance_tagged_count > 0:
+            log.info(
+                "[DRY-RUN] Would tag %s repositories with import provenance",
+                colors.info(str(provenance_tagged_count)),
+            )
+        if (
+            added_count > 0
+            or updated_url_count > 0
+            or pruned_count > 0
+            or provenance_tagged_count > 0
+        ):
             log.info(
                 "\n%s Dry run complete. Would write to %s",
                 colors.warning("→"),

tests/cli/test_import_repos.py

@@ -4138,6 +4138,58 @@ def test_import_dry_run_no_changes_no_write_message(
     assert "Would write to" not in caplog.text
 
 
+def test_import_dry_run_provenance_tag_shows_write_message(
+    tmp_path: pathlib.Path,
+    monkeypatch: MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Dry run reports 'Would write' when only provenance tagging is needed."""
+    caplog.set_level(logging.INFO)
+    monkeypatch.setenv("HOME", str(tmp_path))
+    workspace = tmp_path / "repos"
+    workspace.mkdir()
+    config_file = tmp_path / ".vcspull.yaml"
+
+    # Repo URL matches but NO imported_from tag → provenance tagging needed
+    save_config_yaml(
+        config_file,
+        {
+            "~/repos/": {
+                "repo1": {
+                    "repo": _SSH,
+                },
+            },
+        },
+    )
+
+    importer = MockImporter(repos=[_make_repo("repo1")])
+    _run_import(
+        importer,
+        service_name="github",
+        target="testuser",
+        workspace=str(workspace),
+        mode="user",
+        language=None,
+        topics=None,
+        min_stars=0,
+        include_archived=False,
+        include_forks=False,
+        limit=100,
+        config_path_str=str(config_file),
+        dry_run=True,
+        yes=True,
+        output_json=False,
+        output_ndjson=False,
+        color="never",
+        sync=True,
+        import_source="github:testuser",
+    )
+
+    assert "Would tag 1 repositories" in caplog.text
+    assert "Would write to" in caplog.text
+    assert "No changes to write" not in caplog.text
+
+
 # ---------------------------------------------------------------------------
 # Collision / cross-source prune tests
 # ---------------------------------------------------------------------------