Add vctl and vctx Vault token CLIs

Introduces the vault-tools monorepo: two Go CLIs that share a config file
(~/.config/vault) and token cache (~/.cache/vault) for working with multiple
Vault instances (contexts).

- add shared/ library: config parsing (vctl.yaml/config.yaml, per-context
  overrides, slash contexts), token cache (0600/0700, atomic writes, path-
  traversal guards), and a small hand-rolled Vault HTTP client (login/renew)
- add vctl: login/renew (single or --all), list, --method/--user overrides,
  no-echo password/token prompts, dynamic context completion
- add vctx: resolve a context, set VAULT_ADDR/VAULT_TOKEN/VAULT_NAMESPACE and
  exec the vault CLI, passing remaining args through untouched
- add unit tests across shared/, vctl and vctx command layers (config
  resolution, cache paths, vault client, --all iteration + error aggregation,
  vctx arg pass-through and env construction via fakeable exec/prompt seams)
- add Makefile (build/test/completions/rpm, patch|minor|major version bumps),
  nfpm RPM packaging bundling bash/zsh/fish completions for both binaries
- add Woodpecker pipelines: build/test/pre-commit on PRs, and a tag release
  that cross-compiles, builds+uploads the RPM to artifactapi, and cuts a Gitea
  release (serviceAccountName default, k8s resources on every step)
- add README, per-command docs (docs/vctl.md, docs/vctx.md), AGENTS.md and an
  example config

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

examples/vctl.yaml

@@ -0,0 +1,25 @@
+# Example vault-tools config. Copy to ~/.config/vault/vctl.yaml (or config.yaml)
+# and edit. Read by both vctl and vctx.
+
+# File-level defaults applied to any context that doesn't set its own value.
+defaults:
+  method: ldap        # ldap | userpass | okta | radius | token
+  user: ben           # login user (defaults to $USER if omitted)
+  # namespace: ""     # optional default Vault namespace
+
+contexts:
+  # Simplest form: just an address; inherits method/user from defaults.
+  sydney:
+    address: https://vault.syd1.au.unkin.net
+
+  # Slash-named context nests on disk as ~/.cache/vault/staging/sydney.
+  staging/sydney:
+    address: https://vault-staging.syd1.au.unkin.net
+    namespace: staging
+    user: svc-ben     # per-context override
+
+  # Custom auth method + mount path.
+  legacy:
+    address: https://vault-legacy.example.net
+    method: userpass
+    path: userpass2   # auth mount path (defaults to the method name)