feat(cli): vault_get + deploy-time vault resolution

- Add vault_get wire message to fetch encrypted entries for client-side
  decryption
- Deploy handler resolves $vault: refs: fetches encrypted entries from
  broker, decrypts with mesh keypair locally, sends resolved env over TLS
- File-type vault entries encoded as __vault_file__:path:base64 for
  runner-side extraction

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/broker/src/index.ts

@@ -72,6 +72,7 @@ import {
   vaultSet,
   vaultList,
   vaultDelete,
+  vaultGetEntries,
   upsertService,
   updateServiceStatus,
   updateServiceScope,
@@ -3153,6 +3154,15 @@ function handleConnection(ws: WebSocket): void {
           break;
         }
 
+        case "vault_get": {
+          const vg = msg as any;
+          try {
+            const entries = await vaultGetEntries(conn.meshId, conn.memberId, vg.keys ?? []);
+            sendToPeer(presenceId, { type: "vault_get_result", entries: entries.map((e: any) => ({ key: e.key, ciphertext: e.ciphertext, nonce: e.nonce, sealed_key: e.sealedKey, entry_type: e.entryType, mount_path: e.mountPath })), _reqId: vg._reqId } as any);
+          } catch (e) { sendError(ws, "vault_error", e instanceof Error ? e.message : String(e), undefined, vg._reqId); }
+          break;
+        }
+
         // --- MCP Deploy/Undeploy ---
         case "mcp_deploy": {
           const md = msg as any;