fix: feat: define vault action TOML schema for PR-based approval (#74)

- Add vault/SCHEMA.md documenting the TOML schema for vault actions
- Add validate_vault_action() function to vault/vault-env.sh that:
  - Validates required fields (id, formula, context, secrets)
  - Validates secret names against allowlist
  - Rejects unknown fields
  - Validates formula exists in formulas/
- Create vault/validate.sh script for CLI validation
- Add example TOML files in vault/examples/:
  - webhook-call.toml: Example calling external webhook
  - promote.toml: Example promoting build/artifact
  - publish.toml: Example publishing to ClawHub

vault/examples/webhook-call.toml

@@ -0,0 +1,21 @@
+# vault/examples/webhook-call.toml
+# Example: Call an external webhook with authentication
+#
+# This vault action demonstrates calling an external webhook endpoint
+# with proper authentication via injected secrets.
+
+id = "webhook-call-20260331"
+formula = "run-rent-a-human"
+context = "Notify Slack channel about deployment completion"
+
+# Secrets to inject (only these get passed to the container)
+secrets = ["DEPLOY_KEY"]
+
+# Optional: use sonnet model for this action
+model = "sonnet"
+
+# Optional: enable MCP tools
+tools = []
+
+# Optional: 30 minute timeout
+timeout_minutes = 30