Add multi-arch release workflow, nillsec CLI, and encrypted vault

[Copilot]

Introduces the nillsec encrypted secret vault CLI, its supporting vault package, a multi-arch GitHub Actions release workflow, and security hardening based on code review feedback.

vault package (vault/vault.go)

• Implements Argon2id + AES-256-GCM encrypted secret storage and persistence
• Public API (Init, Load, Save) accepts []byte for passwords, enabling proper in-memory wiping via wipeBytes with no leftover string copies
• parseVaultFile validates salt length (16 bytes) and nonce length (12 bytes) after base64 decode, returning a clean error instead of panicking in cipher.NewGCM
• parseVaultFile handles CRLF line endings (Windows / editor round-trips) by stripping \r from each line before header comparison and field parsing
• Keys() uses sort.Strings from the standard library instead of a custom O(n²) helper

CLI (main.go)

• Commands: init, add, set, get, list, remove, edit, env, version
• NILLSEC_VAULT env var overrides the default secrets.vault path; NILLSEC_PASSWORD allows non-interactive use
• promptPassword and promptPasswordConfirm return []byte directly — term.ReadPassword already returns []byte, so the TTY path has zero unnecessary copies; secrets are zeroed via defer wipeBytes(pw) at every call site
• wipeString removed; password handling uses []byte throughout
• Keys are validated as POSIX identifiers (^[A-Za-z_][A-Za-z0-9_]*$) at add/set time, preventing shell-unsafe names from being stored and making eval "$(nillsec env)" safe by construction
• cmdEdit checks the os.Remove error on the plaintext temp file; on failure it truncates the file to eliminate plaintext before returning an error, ensuring the vault write is skipped while plaintext remains on disk

Release workflow (.github/workflows/release.yml)

• Triggers on v* tags; gates all builds behind go test ./...
• Matrix cross-compiles 7 targets: linux/{amd64,arm64,armv7}, darwin/{amd64,arm64}, windows/{amd64,arm64}
• Version stamped at link time via -X main.version=<tag>
• Publishes a GitHub Release with all binaries + checksums.txt (SHA-256)

Tests (vault/vault_test.go)

• Full coverage of Init/Load/Save round-trips, Set/Get/Delete, key ordering, MarshalText/UnmarshalText
• All errors from vault.Load and os.ReadFile are explicitly checked with t.Fatalf for clear failure attribution
• File-permission assertion guarded by runtime.GOOS != "windows" for cross-platform portability
• New tests: CRLF vault file loading, truncated-salt rejection, truncated-nonce rejection

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR introduces the nillsec Go CLI and its encrypted vault implementation, and adds a GitHub Actions workflow to build and publish multi-arch release binaries with SHA-256 checksums.

Changes:

• Add vault package implementing Argon2id + AES-256-GCM encrypted secret storage and persistence.
• Add nillsec CLI commands (init/add/set/get/list/remove/edit/env/version) and update docs/gitignore accordingly.
• Add multi-arch release workflow that cross-compiles on tag pushes and publishes a GitHub Release with checksums.

Reviewed changes

Copilot reviewed 6 out of 9 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
.github/workflows/release.yml	Builds/test/releases tagged versions across multiple GOOS/GOARCH targets and publishes release assets + checksums.
main.go	Implements CLI commands, password prompting, edit flow, and env export.
vault/vault.go	Adds encrypted vault format, KDF/encryption, and vault CRUD helpers.
vault/vault_test.go	Adds tests for init/load/save, CRUD, marshaling, and ciphertext variability.
README.md	Documents features, vault format, usage, and environment variables.
.gitignore	Ignores build outputs and Go test cache.
go.mod / go.sum	Adds module metadata and dependencies (x/crypto, x/term).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.