Add vctl and vctx Vault token CLIs

Introduces the vault-tools monorepo: two Go CLIs that share a config file
(~/.config/vault) and token cache (~/.cache/vault) for working with multiple
Vault instances (contexts).

- add shared/ library: config parsing (vctl.yaml/config.yaml, per-context
  overrides, slash contexts), token cache (0600/0700, atomic writes, path-
  traversal guards), and a small hand-rolled Vault HTTP client (login/renew)
- add vctl: login/renew (single or --all), list, --method/--user overrides,
  no-echo password/token prompts, dynamic context completion
- add vctx: resolve a context, set VAULT_ADDR/VAULT_TOKEN/VAULT_NAMESPACE and
  exec the vault CLI, passing remaining args through untouched
- add unit tests across shared/, vctl and vctx command layers (config
  resolution, cache paths, vault client, --all iteration + error aggregation,
  vctx arg pass-through and env construction via fakeable exec/prompt seams)
- add Makefile (build/test/completions/rpm, patch|minor|major version bumps),
  nfpm RPM packaging bundling bash/zsh/fish completions for both binaries
- add Woodpecker pipelines: build/test/pre-commit on PRs, and a tag release
  that cross-compiles, builds+uploads the RPM to artifactapi, and cuts a Gitea
  release (serviceAccountName default, k8s resources on every step)
- add README, per-command docs (docs/vctl.md, docs/vctx.md), AGENTS.md and an
  example config

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

packaging/nfpm.yaml

@@ -0,0 +1,64 @@
+---
+# nfpm config for building the vault-tools RPM (vctl + vctx).
+# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - vault-tools
+provides:
+  - vault-tools
+
+contents:
+  # The CLI binaries.
+  - src: dist/vctl
+    dst: /usr/bin/vctl
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: dist/vctx
+    dst: /usr/bin/vctx
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Shell completions (generated by scripts/build-rpm.sh before packaging).
+  - src: dist/completions/vctl.bash
+    dst: /usr/share/bash-completion/completions/vctl
+    file_info:
+      mode: 0644
+  - src: dist/completions/_vctl
+    dst: /usr/share/zsh/site-functions/_vctl
+    file_info:
+      mode: 0644
+  - src: dist/completions/vctl.fish
+    dst: /usr/share/fish/vendor_completions.d/vctl.fish
+    file_info:
+      mode: 0644
+  - src: dist/completions/vctx.bash
+    dst: /usr/share/bash-completion/completions/vctx
+    file_info:
+      mode: 0644
+  - src: dist/completions/_vctx
+    dst: /usr/share/zsh/site-functions/_vctx
+    file_info:
+      mode: 0644
+  - src: dist/completions/vctx.fish
+    dst: /usr/share/fish/vendor_completions.d/vctx.fish
+    file_info:
+      mode: 0644