#238 vault: add read-secret CLI command for agent-driven secret retrieval

Feature Request

Currently the vault CLI surface supports:

• vault put <vault> <key> [value] — store a secret ✅
• vault list-keys [vault] — list keys without values ✅
• vault get <vault> — show vault config (not secrets) ✅
• No way to read a secret value via CLI ❌

The error message from vault get test-vault api-key even says:

Unexpected argument: api-key. To retrieve a secret value, use: swamp vault list-keys <vault_name>

But list-keys only shows key names, not values.

Use Case

Agents need to read secrets programmatically for:

1. Workflow debugging — verify a secret was stored correctly before running a workflow
2. Secret rotation — read old value, generate new, put new, verify
3. Cross-vault migration testing — verify migrated secrets match originals
4. Composing secrets — read a base URL from vault, append path, use in model input

Proposed API

# Read a single secret value (requires --force or interactive confirm for safety)
swamp vault read <vault_name> <key> --force --json
# Output: { "key": "api-key", "value": "sk-test-...", "vault": "test-vault" }

# Or extend 'vault get' to accept a key:
swamp vault get <vault_name> <key> --json

Security Considerations

• Require explicit --force flag (no accidental secret leakage in interactive mode)
• In --json mode, mark the value field so log-redaction can scrub it
• Consider --masked flag that shows first/last 4 chars only (for verification without full exposure)
• Audit log entry when a secret is read via CLI

Environment

• swamp version: 20260504.233645.0-sha.430c1535