feat: container-based Bitwarden CLI, no host Node.js

Adds the dockerized bw deployment in production use on the TSGCOO
orchestration host since 2026-08-13: pinned debian-slim image carrying
the pre-compiled bw binary, an in-container auth lifecycle entrypoint
(config, API-key login, unlock, sync), a transparent host wrapper, and
a one-command installer.

ADR-002 records the decision and supersedes ADR-001 for BW CLI
purposes: hosts keep zero language runtimes. Known caveat documented:
the upstream "native" binary is a Node.js SEA, so Node is embedded in
the image though absent from all hosts.

Shellcheck clean (zero warnings incl. info-level).

bin/bw-cli.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
+#
+# Provides transparent `bw` access on hosts where the CLI is not installed
+# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
+# container (debian-slim + ca-certificates, NO Node.js).
+#
+# All tool execution happens inside the container. Nothing runs on the host
+# except this wrapper, which only invokes docker.
+#
+# Usage:
+#   bw-cli.sh status                 Check vault status
+#   bw-cli.sh list items             List vault items
+#   bw-cli.sh list collections       List collections
+#   bw-cli.sh get password "Item"    Retrieve a password
+#   bw-cli.sh get totp "Item"        Retrieve a TOTP code
+#   bw-cli.sh get item "Item"        Full item JSON
+#   bw-cli.sh generate -ulns         Generate a password
+#
+# Install to ~/.local/bin/bw via:
+#   scripts/bw-install.sh
+#
+# Environment overrides:
+#   BW_ENV_FILE   Path to credentials (default: ~/.config/bw/env)
+#   BW_IMAGE      Docker image (default: reachableceo-bw-native:2026.7.0)
+#   BW_VOLUME     Docker volume for persisted login state
+#                 (default: tsys-bw-cli-state)
+#   BW_LIB_DIR    Directory containing entrypoint.sh (default: ~/.local/share/bw)
+
+set -euo pipefail
+
+BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
+BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
+BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
+BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
+
+# --- Validate prerequisites ---
+if [ ! -f "$BW_ENV_FILE" ]; then
+    echo "bw: credential file not found: $BW_ENV_FILE" >&2
+    echo "    expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
+    exit 1
+fi
+
+if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
+    echo "bw: Docker image not found: $BW_IMAGE" >&2
+    echo "    build it: scripts/bw-install.sh" >&2
+    exit 1
+fi
+
+if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
+    echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
+    echo "    install via: scripts/bw-install.sh" >&2
+    exit 1
+fi
+
+# --- Load credentials (values are single-quoted in env file) ---
+set -a
+# shellcheck source=/dev/null
+. "$BW_ENV_FILE"
+set +a
+
+# --- Create persistent volume for BW CLI login state ---
+docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
+
+# --- Run bw inside the container ---
+docker run --rm -i \
+    -e BW_CLIENTID \
+    -e BW_CLIENTSECRET \
+    -e BW_PASSWORD \
+    -e BW_SERVER \
+    -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
+    -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
+    --entrypoint sh \
+    "$BW_IMAGE" \
+    /opt/bw/entrypoint.sh "$@"