Add agentvault with a seed-outpost subcommand

Interactive agents are classifier-blocked from plumbing credentials through
a shell, so seeding an Authentik outpost token into Vault KV needs to happen
inside one binary invocation that never exposes the secret.

- Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login
  (role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged).
- Add `agentvault seed-outpost`: read the Authentik API token from
  kv/service/authentik/agent-api-token (field `token`, falling back to
  `api_token`), exact-match the outpost by name via the instances search,
  fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it
  to --dest-path under --dest-key.
- Print only the outpost name, token identifier, dest path and new KV
  version; keep secret material out of results, errors and logs.
- Distinguish the failure stages (login, KV read denied, outpost missing,
  view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/
  ErrOutpostNotFound sentinels and actionable messages.
- Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and
  authentik.go (outpost search + view_key) for reuse by future flows.
- Cover the happy path, idempotent re-run, field fallback and every failure
  mode with httptest servers, including a leak check on error strings.
- Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release
  cross-builds/assets, README and AGENTS.md.

packaging/nfpm.yaml

@@ -42,6 +42,12 @@ contents:
       mode: 0755
       owner: root
       group: root
+  - src: dist/agentvault
+    dst: /usr/bin/agentvault
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
 
   # Shell completions (generated by scripts/build-rpm.sh before packaging).
   - src: dist/completions/agentpr.bash
@@ -80,3 +86,15 @@ contents:
     dst: /usr/share/fish/vendor_completions.d/agentws.fish
     file_info:
       mode: 0644
+  - src: dist/completions/agentvault.bash
+    dst: /usr/share/bash-completion/completions/agentvault
+    file_info:
+      mode: 0644
+  - src: dist/completions/_agentvault
+    dst: /usr/share/zsh/site-functions/_agentvault
+    file_info:
+      mode: 0644
+  - src: dist/completions/agentvault.fish
+    dst: /usr/share/fish/vendor_completions.d/agentvault.fish
+    file_info:
+      mode: 0644