v0.10 — Vault Agent: a secret without a token

Everything before this showed Vault holding and issuing secrets. Nothing
showed an application actually consuming one.

That gap matters, because the usual answer — give the app a Vault token
and let it call the API — moves the problem rather than solving it. The
token is now a long-lived credential sitting in the application's
environment, which is the thing Vault was adopted to get rid of.

What this adds

A vault-agent service that deliberately has no VAULT_TOKEN. It
authenticates with an AppRole whose credentials are placed on disk by
bootstrap-agent.sh, and renders a dynamic Postgres credential into
/rendered/db.env.

The application reads a file. It never learns Vault exists, holds no
token, and needs no Vault client library.

Agent handles the parts that are tedious to get right by hand: renewing
the lease before it expires, re-authenticating when the token cannot be
renewed further, and re-rendering the template when the credential
changes.

Also in this release

Several fixes from running it for real rather than reading the docs —
starting Agent the way its base image expects, giving it somewhere it can
actually write, giving a restarted node its logs, and a curl fallback
that printed 000000 on connection failure because curl already prints
000 itself and the || echo 000 appended a second one.

See docs/vault-agent.md.