feat: add agent integration guide and get-secret/render-env tools

scripts/render-env.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+VAULT_FILE="${VAULT_FILE:-$REPO_DIR/secrets/vault.yml}"
+VAULT_PASS_FILE="${VAULT_PASS_FILE:-$HOME/.config/continuous-ai-workflow-spec/vault-pass.txt}"
+
+SECTION="${1:-}"
+[ -n "$SECTION" ] || { echo "用法: $0 <section>"; exit 1; }
+
+TMP_DEC=$(mktemp)
+chmod 600 "$TMP_DEC"
+ansible-vault decrypt "$VAULT_FILE" --vault-password-file "$VAULT_PASS_FILE" --output "$TMP_DEC" 2>/dev/null
+
+python3 - <<PY
+import yaml
+from pathlib import Path
+
+data = yaml.safe_load(Path('$TMP_DEC').read_text())
+section_data = data.get('$SECTION', {})
+prefix = '${SECTION^^}'.replace('-', '_')
+
+for key, val in section_data.items():
+    if isinstance(val, dict):
+        for subkey, subval in val.items():
+            print(f"{prefix}_{key.upper()}_{subkey.upper()}={subval}")
+    else:
+        print(f"{prefix}_{key.upper()}={val}")
+PY
+
+rm -f "$TMP_DEC"