fix: feat: define vault action TOML schema for PR-based approval (#74)

- Add vault/SCHEMA.md documenting the TOML schema for vault actions
- Add validate_vault_action() function to vault/vault-env.sh that:
  - Validates required fields (id, formula, context, secrets)
  - Validates secret names against allowlist
  - Rejects unknown fields
  - Validates formula exists in formulas/
- Create vault/validate.sh script for CLI validation
- Add example TOML files in vault/examples/:
  - webhook-call.toml: Example calling external webhook
  - promote.toml: Example promoting build/artifact
  - publish.toml: Example publishing to ClawHub

vault/examples/promote.toml

@@ -0,0 +1,21 @@
+# vault/examples/promote.toml
+# Example: Promote a build/artifact to production
+#
+# This vault action demonstrates promoting a built artifact to a
+# production environment with proper authentication.
+
+id = "promote-20260331"
+formula = "run-supervisor"
+context = "Promote build v1.2.3 to production environment"
+
+# Secrets to inject for deployment authentication
+secrets = ["DEPLOY_KEY", "DOCKER_HUB_TOKEN"]
+
+# Optional: use larger model for complex deployment logic
+model = "sonnet"
+
+# Optional: enable MCP tools for container operations
+tools = ["docker"]
+
+# Optional: deployments may take longer
+timeout_minutes = 45