feat: port legacy KNELSecretsManager (bw-* tooling, ADRs, tests) [#769]

Secret-scanned clean (placeholder values only). Bitwarden tooling is
the head start for the Vaultwarden-SoR bootstrap (#770). legacy-* trees
exempt from lint/pointer checks (historical verbatim code).

https://projects.knownelement.com/issues/769#note-4152

legacy-knelsecretsmanager/docker/bw-native/Dockerfile

@@ -0,0 +1,23 @@
+# Dockerfile — Native Bitwarden CLI (Rust binary, no Node.js)
+#
+# Builds a minimal container image around the pre-compiled native bw CLI
+# binary from the official Bitwarden GitHub releases. The binary is a
+# Rust executable with glibc dependencies. No Node.js runtime is
+# included or required.
+#
+# Build prerequisites:
+#   1. Download the native binary:
+#      https://github.com/bitwarden/clients/releases/download/cli-v2026.7.0/bw-linux-2026.7.0.zip
+#   2. Unzip and place the `bw` executable next to this Dockerfile.
+#   3. Build: docker build -t reachableceo-bw-native:2026.7.0 .
+#
+# Or use the installer: scripts/bw-install.sh
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+
+COPY bw /usr/local/bin/bw
+RUN chmod +x /usr/local/bin/bw
+
+ENTRYPOINT ["bw"]