Add passv: a Vault-backed drop-in for pass

Provide a password-store CLI that keeps pass's on-disk layout (<name>.gpg
binary OpenPGP under $PASSWORD_STORE_DIR) but routes all encryption and
decryption through a vault-plugin-secrets-gpg engine mount, so the GPG private
key never lives on the client.

- Implement init/show/ls/insert/generate/edit/rm/mv/cp/find/grep/git with
  pass-compatible flags and implicit `passv <name>`=show dispatch.
- Resolve the recipient from a Vault ref: .gpg-id holds <mount>/<key> for
  passv-native stores, or a sibling .vault-id lets a store keep real GPG
  fingerprints in .gpg-id for dual gpg+Vault use.
- mv/cp re-encrypt across differing recipients; same-recipient moves copy the
  ciphertext verbatim.
- Ship the sibling build/packaging/CI: nfpm RPM to /usr/bin/passv (artifactapi
  rpm-internal on v* tag), Woodpecker PR/release pipelines, unit tests plus a
  real-Vault e2e that also proves dual gpg+Vault decryption.
- README covers store creation, migrating a GPG pass store, and dual-mode.

clip.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+)
+
+// clipTool is a detected clipboard backend and the command that writes stdin to
+// the clipboard (the same command with empty stdin clears it).
+type clipTool struct{ copy []string }
+
+func detectClipTool() *clipTool {
+	candidates := [][]string{
+		{"wl-copy"},
+		{"xclip", "-selection", "clipboard"},
+		{"xsel", "-b", "-i"},
+		{"pbcopy"},
+	}
+	for _, c := range candidates {
+		if _, err := exec.LookPath(c[0]); err == nil {
+			return &clipTool{copy: c}
+		}
+	}
+	return nil
+}
+
+func clipTime() int {
+	return atoiDefault(os.Getenv("PASSWORD_STORE_CLIP_TIME"), 45)
+}
+
+// copyClip places text on the clipboard and schedules a detached job to clear it
+// after PASSWORD_STORE_CLIP_TIME seconds.
+func copyClip(text string) error {
+	tool := detectClipTool()
+	if tool == nil {
+		return errf("no clipboard tool found (install wl-clipboard, xclip, or xsel)")
+	}
+
+	c := exec.Command(tool.copy[0], tool.copy[1:]...)
+	c.Stdin = strings.NewReader(text)
+	if err := c.Run(); err != nil {
+		return fmt.Errorf("copying to clipboard: %w", err)
+	}
+
+	// Detached clear: new process group so it outlives this CLI invocation.
+	clearSh := fmt.Sprintf("sleep %d; printf '' | %s", clipTime(), strings.Join(tool.copy, " "))
+	clear := exec.Command("sh", "-c", clearSh)
+	clear.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	return clear.Start()
+}