Interactive agents are classifier-blocked from plumbing credentials through
a shell, so seeding an Authentik outpost token into Vault KV needs to happen
inside one binary invocation that never exposes the secret.
- Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login
(role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged).
- Add `agentvault seed-outpost`: read the Authentik API token from
kv/service/authentik/agent-api-token (field `token`, falling back to
`api_token`), exact-match the outpost by name via the instances search,
fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it
to --dest-path under --dest-key.
- Print only the outpost name, token identifier, dest path and new KV
version; keep secret material out of results, errors and logs.
- Distinguish the failure stages (login, KV read denied, outpost missing,
view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/
ErrOutpostNotFound sentinels and actionable messages.
- Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and
authentik.go (outpost search + view_key) for reuse by future flows.
- Cover the happy path, idempotent re-run, field fallback and every failure
mode with httptest servers, including a leak check on error strings.
- Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release
cross-builds/assets, README and AGENTS.md.
