feat: branch protection on ops repo — require admin approval for vault PRs
feat: rewrite dispatcher — poll for merged vault PRs, enforce admin approval
feat: lib/vault.sh — helper for agents to create vault PRs on ops repo
feat: define vault action TOML schema for PR-based approval
chore: tear down old vault scripts — prepare for PR-based vault