draft: add vault foundation for encrypted store

[xaaha]

Summary

• add the initial pkg/vault foundation for age-based encrypted store support
• add identity/keypair, encryption/decryption, and store read/write coverage with tests
• update related utilities needed by the vault layer

What is included

• pkg/vault/crypto.go and tests
• pkg/vault/keys.go and tests
• pkg/vault/store.go and tests
• pkg/vault/vault.go and tests
• utility support for config/project marker resolution
• action/template test updates touched by the vault integration work

Why this is a draft PR

This branch appears to be a strong first implementation of #126, but it may not fully match the final issue scope yet.

Notably, the issue body still describes some broader foundation expectations, such as:

• identity fallback chain via HULAK_MASTER_KEY
• clearer recipient-loading foundation for multi-recipient support
• final bootstrap boundary decisions between #126 and #130

This PR is intentionally targeting the integration branch epic/encryption-v0.3, not main, so follow-up encryption tickets can stack cleanly without blocking bugfix work on main.

Validation

• go test ./...
• pkg/vault LSP diagnostics clean

Related

• vault: age encryption + file-based identity management #126
• base branch for epic work: epic/encryption-v0.3