pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832

.gitea/workflows/ci.yml

@@ -0,0 +1,21 @@
+# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan. No Rust in the chain.
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  vet:
+    runs-on: ultix
+    container:
+      image: golang:1.23-alpine
+    steps:
+      - run: apk add --no-cache nodejs git
+      - uses: actions/checkout@v4
+      - run: gofmt -l cli/ | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
+      - run: cd cli && go vet ./... && go build ./...
+      - name: secret scan
+        run: |
+          if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
+            echo "::error::secret material committed"; exit 1
+          fi