fix: [nomad-step-5] S5.5 — wire --with edge,staging,chat + vault-runner + full deploy ordering (#992)

lib/hvault.sh

@@ -405,3 +405,27 @@ hvault_token_lookup() {
     return 1
   }
 }
+
+# _hvault_seed_key — Seed a KV key if it doesn't exist. Returns 0=created, 1=unchanged.
+# Args: path, key, [generator_func]
+#   path: KV v2 path (e.g., "disinto/shared/chat")
+#   key: key name within the path (e.g., "chat_oauth_client_id")
+#   generator: function that outputs a random value (default: openssl rand -hex 32)
+# Usage:
+#   _hvault_seed_key "disinto/shared/chat" "chat_oauth_client_id" "openssl rand -hex 32"
+#   local rc=$?  # 0 = created, 1 = unchanged
+_hvault_seed_key() {
+  local path="$1" key="$2" generator="${3:-openssl rand -hex 32}"
+  local existing value
+
+  # Check if key already exists
+  existing=$(hvault_kv_get "$path" "$key" 2>/dev/null) || true
+  if [ -n "$existing" ]; then
+    return 1  # unchanged
+  fi
+
+  # Generate and write the value
+  value=$(eval "$generator")
+  hvault_kv_put "$path" "${key}=${value}"
+  return 0  # created
+}