feat(cli): add secure local vault and native distribution

[nkavian]

Summary

• Add an encrypted, multi-tenant local vault daemon for CLI and MCP credentials with authenticated peer transport and hardened secret handling.
• Integrate vault lifecycle, migration cleanup, cross-platform packaging, installers, and security regression coverage.
• Support signed macOS and Linux releases while retaining manual Windows packaging until Microsoft Artifact Signing is available.

Verification

Full typecheck, lint, test coverage, TypeDoc, formatting, macOS security packaging, Linux AMD64/ARM64 packaging, signed repository, installer, and production signing-verification checks passed.

[codecov]

Codecov Report

❌ Patch coverage is 90.17837% with 446 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/core/src/secure-storage/vault-daemon.ts	71.78%	112 Missing ⚠️
packages/cli/src/commands/vault/index.ts	90.64%	39 Missing ⚠️
packages/cli/src/commands/aep/index.tsx	82.38%	32 Missing and 5 partials ⚠️
...ges/core/src/secure-storage/vault-peer-verifier.ts	83.87%	28 Missing and 2 partials ⚠️
packages/core/src/secure-storage/vault-socket.ts	89.58%	29 Missing and 1 partial ⚠️
packages/core/src/secure-storage/vault-client.ts	89.95%	21 Missing ⚠️
packages/core/src/secure-storage/sqlite.ts	81.48%	20 Missing ⚠️
...ges/core/src/secure-storage/vault-protected-key.ts	81.63%	18 Missing ⚠️
...kages/core/src/secure-storage/vault-broker-auth.ts	92.76%	17 Missing ⚠️
...core/src/secure-storage/vault-sync-secret-store.ts	91.20%	16 Missing ⚠️
... and 18 more

📢 Thoughts on this report? Let us know!