vault-cli: -m/--provider flags on analyze, git-commit on sync-data, gitignore pyc

- vault analyze now accepts -m MODEL and --provider PROVIDER, passed through to
  hermes -z, so intelligence/spend can be dialed inline per cadence (nightly cheap
  on Haiku/bedrock, ad-hoc on the default smart model).
- sync-data --execute now git-commits like the other write ops (was the only
  mutating op that skipped the commit).
- gitignore + untrack __pycache__/*.pyc build artifacts.

vault

@@ -15,7 +15,11 @@ Subcommands:
   vault sync-data               reconcile /data skeleton to match manifest (create missing dirs)
   vault manifest                regenerate the topology manifest note
   vault report [--pretty]       deterministic Librarian report (delegates to vault-librarian.py)
-  vault analyze                 spawn a Hermes Librarian pass (ad-hoc; uses the cron prompt)
+  vault analyze [-m MODEL] [--provider PROVIDER]
+                                spawn a Hermes Librarian pass (ad-hoc; uses the cron prompt).
+                                -m/--provider dial intelligence/spend inline. e.g. nightly cheap:
+                                  vault analyze -m us.anthropic.claude-haiku-4-5-20251001-v1:0 --provider bedrock
+                                omit both to use the profile's default (smart) model.
 """
 import os, re, sys, subprocess
 
@@ -131,7 +135,22 @@ def main():
         sys.exit(subprocess.run([sys.executable, LIBRARIAN] + argv).returncode)
     elif cmd == "analyze":
         prompt = open(PROMPT, encoding="utf-8").read()
-        subprocess.run([HERMES, "-z", prompt])
+        # `vault analyze [-m MODEL]` — pass an inline Bedrock/other model through to hermes -z
+        # so intelligence/spend can be dialed per cadence (nightly cheap, ad-hoc smart).
+        hcmd = [HERMES, "-z", prompt]
+        if "-m" in argv:
+            i = argv.index("-m")
+            if i + 1 < len(argv):
+                hcmd += ["-m", argv[i + 1]]
+            else:
+                die("-m requires a model name (e.g. vault analyze -m us.anthropic.claude-haiku-4-5-20251001-v1:0)")
+        if "--provider" in argv:
+            i = argv.index("--provider")
+            if i + 1 < len(argv):
+                hcmd += ["--provider", argv[i + 1]]
+            else:
+                die("--provider requires a provider name (e.g. vault analyze --provider bedrock)")
+        subprocess.run(hcmd)
     else:
         die(f"unknown command '{cmd}'")