Document agent secret vault installation

scripts/create-vault-pass-archive.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SRC="${VAULT_PASS_FILE:-$HOME/.config/vault-pass.txt}"
+OUT="${1:-$REPO_DIR/secrets/vault-pass.txt.zip}"
+
+usage() {
+  cat <<USAGE
+Usage: scripts/create-vault-pass-archive.sh [output.zip]
+
+Creates a password-protected archive containing vault-pass.txt.
+Default source:
+  ${VAULT_PASS_FILE:-$HOME/.config/vault-pass.txt}
+Default output:
+  $REPO_DIR/secrets/vault-pass.txt.zip
+
+The zip password is entered interactively. Do not print it in logs/chat.
+USAGE
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+if [ ! -f "$SRC" ]; then
+  echo "Missing source vault password file: $SRC" >&2
+  exit 2
+fi
+
+if ! command -v zip >/dev/null 2>&1; then
+  echo "Missing dependency: zip" >&2
+  echo "Install it with: sudo apt install -y zip" >&2
+  exit 3
+fi
+
+mkdir -p "$(dirname "$OUT")"
+tmpdir="$(mktemp -d)"
+cleanup() { rm -rf "$tmpdir"; }
+trap cleanup EXIT
+install -m 600 "$SRC" "$tmpdir/vault-pass.txt"
+
+(
+  cd "$tmpdir"
+  # zip prompts for archive password interactively.
+  zip -e -q "$OUT" vault-pass.txt
+)
+chmod 600 "$OUT"
+echo "Created password-protected archive: $OUT"