vault-cli: Librarian tooling for the R/J/F/I vault

Adds packages/vault-cli (the `vault` CLI: search/show/tree, clobber-safe
create/move/rename across both /vault and /data + manifest regen, sync-data,
report, analyze) and wires it onto $PATH via modules/hosts/core/vault.nix for
server + vault-client hosts. Scripts self-locate siblings via realpath so they
run from the Nix store. Includes the deterministic $0 report generator, the
topology-manifest generator, and the shared Librarian prompt.

package.nix

@@ -0,0 +1,46 @@
+# packages/vault-cli/package.nix — the `vault` CLI + Librarian tooling derivation.
+#
+# Bundles the dispatcher (`vault`), its write-ops + shared library, the deterministic
+# report generator, the topology-manifest generator, and the shared Librarian prompt.
+# Exposes `vault` on $PATH. All scripts self-locate their siblings via realpath(__file__),
+# so they run identically from the Nix store, the repo, or a dev checkout. python3 is baked
+# into the wrapper — the host does not need its own python3.
+{ stdenv, python3, lib }:
+
+stdenv.mkDerivation {
+  pname = "vault-cli";
+  version = "0.1.0";
+  src = ./.;
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    runHook preInstall
+
+    libexec="$out/libexec/vault-cli"
+    mkdir -p "$libexec" "$out/bin"
+
+    cp vault vault_lib.py vault_ops.py vault-librarian.py vault-topology.py \
+       vault-librarian-prompt.md "$libexec/"
+    chmod +x "$libexec/vault"
+
+    # Wrapper: always invoke our pinned python3 on the staged dispatcher.
+    makeWrapperArgs=""
+    printf '#!%s/bin/python3\n' "${python3}" > "$out/bin/vault"
+    printf 'import os, sys\n' >> "$out/bin/vault"
+    printf 'os.execv("%s/bin/python3", ["%s/bin/python3", "%s/vault"] + sys.argv[1:])\n' \
+      "${python3}" "${python3}" "$libexec" >> "$out/bin/vault"
+    chmod +x "$out/bin/vault"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "vault CLI + Librarian tooling for the R/J/F/I Obsidian vault";
+    mainProgram = "vault";
+    platforms = platforms.linux;
+  };
+}