fix: Extract vault-env.sh to deduplicate vault token override

Moves shared env.sh sourcing + vault-bot token override into
vault/vault-env.sh so the three vault sub-scripts no longer share
a duplicate 5-line block.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vault/vault-reject.sh

@@ -6,9 +6,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "${SCRIPT_DIR}/../lib/env.sh"
-# Use vault-bot's own Forgejo identity (#747)
-FORGE_TOKEN="${FORGE_VAULT_TOKEN:-${FORGE_TOKEN}}"
+source "${SCRIPT_DIR}/vault-env.sh"
 
 VAULT_DIR="${FACTORY_ROOT}/vault"
 LOGFILE="${VAULT_DIR}/vault.log"