Add agentvault seed-oauth for oauth2-proxy credentials

Seeding an oauth2-proxy secret by hand means an agent shell-plumbing a
client secret and a cookie secret, which the classifier blocks. seed-oauth
does it in one self-contained invocation: it reads the KV path, fills in
only the keys that are missing, preserves everything else and prints key
names and the new version, never a value.

- Add SeedOAuth in internal/agent: read-modify-write of the client_id,
  client_secret and cookie_secret keys with per-key created/kept/rotated
  actions and a no-op when nothing changed.
- Generate secrets from 32 crypto/rand bytes; cookie_secret is base64url so
  it decodes to exactly the 32 bytes oauth2-proxy requires.
- Add ReadKVOptional (missing secret = empty) and WriteKVAny (non-string
  fields survive a round trip) to the KV-v2 client.
- Wire the seed-oauth subcommand and document it in README and AGENTS.md.
- Cover fresh create, patch-preserves-client_secret, other-key
  preservation, --rotate, idempotence, denial errors and secret leakage.

cmd/agentvault/main.go

@@ -3,11 +3,13 @@
 // with the same Vault AppRole as agentpr (role_id only, no secret_id).
 //
 //	agentvault seed-outpost --outpost <name> --dest-path <kv/path>
+//	agentvault seed-oauth --path <kv/path> --client-id <id>
 package main
 
 import (
 	"fmt"
 	"os"
+	"strings"
 
 	"git.unkin.net/unkin/agent-tools/internal/agent"
 
@@ -33,7 +35,7 @@ func newRootCmd() *cobra.Command {
 		SilenceUsage: true,
 	}
 	root.SetVersionTemplate("{{.Version}}\n")
-	root.AddCommand(newSeedOutpostCmd(), newVersionCmd())
+	root.AddCommand(newSeedOutpostCmd(), newSeedOAuthCmd(), newVersionCmd())
 	return root
 }
 
@@ -73,6 +75,48 @@ func newSeedOutpostCmd() *cobra.Command {
 	return cmd
 }
 
+func newSeedOAuthCmd() *cobra.Command {
+	opts := agent.SeedOAuthOptions{}
+	cmd := &cobra.Command{
+		Use:   "seed-oauth",
+		Short: "Seed an oauth2-proxy credential set into Vault KV",
+		Long: "Make a Vault KV-v2 path hold a complete oauth2-proxy credential set: the\n" +
+			"given client_id, plus a client_secret and a 32-byte cookie_secret that are\n" +
+			"generated only when missing (or with --rotate). Existing keys are preserved\n" +
+			"and nothing is written when the secret is already correct. Secret values are\n" +
+			"never printed or logged.",
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			opts.VaultAddr = agent.VaultAddr()
+			opts.RoleID = agent.RoleID()
+			res, err := agent.SeedOAuth(opts)
+			if err != nil {
+				return err
+			}
+			out := cmd.OutOrStdout()
+			_, _ = fmt.Fprintf(out, "path:          %s/%s\n", res.KVMount, res.Path)
+			_, _ = fmt.Fprintf(out, "keys:          %s\n", strings.Join(res.KeyNames(), ", "))
+			for _, k := range res.Keys {
+				_, _ = fmt.Fprintf(out, "  %-14s %s\n", k.Name+":", k.Action)
+			}
+			if res.Changed {
+				_, _ = fmt.Fprintf(out, "version:       %d\n", res.Version)
+			} else {
+				_, _ = fmt.Fprintf(out, "version:       unchanged\n")
+			}
+			return nil
+		},
+	}
+	f := cmd.Flags()
+	f.StringVar(&opts.Path, "path", "", "KV-v2 path holding the credentials, e.g. kubernetes/namespace/repospawner/default/oauth-credentials (required)")
+	f.StringVar(&opts.ClientID, "client-id", "", "OIDC client id to store (required)")
+	f.StringVar(&opts.KVMount, "kv-mount", agent.DefaultKVMount, "KV-v2 mount holding the path")
+	f.BoolVar(&opts.Rotate, "rotate", false, "Regenerate client_secret and cookie_secret even when they already exist")
+	_ = cmd.MarkFlagRequired("path")
+	_ = cmd.MarkFlagRequired("client-id")
+	return cmd
+}
+
 func newVersionCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:          "version",