The offline command block for **M1 - Config + registry**. Second of two
PRs. **Stacked on #212** (base = `feature/m1-config-schema`) -
review/merge #212 first, then this retargets to master.

## What (all offline - no network, no auth)
- **`vault list [--json]`** - name / type / path, one line each (remote
shown for git, server for couchdb); friendly hint when empty.
- **`vault add <name>`** - `--local` (a folder that never syncs) or
`--git <remote>` (`--interval`, default 5m); `--path` (default
`~/vaults/<name>`, created if missing). Writes a valid entry, provisions
nothing.
- **`vault remove <name>`** - unregisters + drops
`~/.agentage/index/<name>.db`; markdown stays on disk.
- **`update [--check]`** - `--check` reports the verdict; otherwise `npm
i -g @agentage/cli@latest` when the registry says we're behind
(installer injected for tests). Passive check already rides `status`.
- `vault-registry.ts` holds the pure add/remove/index-path/format logic;
commands take injected `Deps`.

## Deferred (not in this PR)
- **couchdb-default `vault add`** (the account path) - `vault add` with
no flag errors with guidance. It needs `POST /vaults` provisioning + the
**V4 couch-channel** call, so it lands in the provisioning slice.
- Publishing `vaults.schema.json` on the landing (separate landing-repo
PR).

## Verify
- `npm run verify` green: type-check (src + e2e), eslint, prettier,
**109 unit tests**, build.
- **Ran the built binary end to end** (temp config dir): add
`--local`/`--git`, list + `--json`, duplicate -> exit 1, no-flag ->
"needs provisioning" exit 1, remove leaves files, `vaults.json` written
valid with `$schema` first + git sync defaults filled.
- **Offline e2e tier (@p0)** passes locally (`npx playwright test
vault-offline`, 2 passed): add -> list -> remove with no network.

## Verify (for you)
Open the diff; optionally `npm run build && node dist/cli.js vault add
demo --local --path /tmp/demo && node dist/cli.js vault list`.

E2E hardening for **M1** - covers every M1 acceptance criterion with
end-to-end tests. **Stacked on #213** (base =
`feature/m1b-vault-commands`); lands after #212 -> #213.

Adds `e2e/m1-requirements.test.ts` (@p0), driving the built
`dist/cli.js` against a per-test temp config dir. All offline except
`update --check` (which the verb tolerates on any network state).

## Coverage (9 tests)
| Requirement | Test |
|---|---|
| `vault add --git` writes a valid entry (interval + `$schema`) | ✓ |
| `--git` requires a remote value | ✓ |
| duplicate name rejected | ✓ |
| allowlist-failing name rejected | ✓ |
| **empty `vaults.json` still carries the `$schema` link** | ✓ |
| `remove` keeps markdown on disk, drops the index db | ✓ |
| `vaults.yaml` accepted; JSON wins when both exist | ✓ |
| malformed / unknown-type config fails loudly | ✓ |
| `update --check` reports a verdict, exits 0, never installs | ✓ |

## Verify
- `npx playwright test m1-requirements vault-offline` -> **11 passed**
locally (9 new + 2 from #213), 3.1s.
- `type-check:e2e` + `format:check` green.

Stack merge order: **#212 -> #213 -> this**. CI runs once the stack
rebases onto master.