pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832

docs/ADR-003-GoCLI.md

@@ -0,0 +1,25 @@
+# ADR-003: Custom Go CLI replaces the upstream Rust bw binary
+
+Date: 2026-09-06. Decided by founder directive (finish the project with our
+custom Go cli, not the upstream rust one; no Rust supply-chain risk).
+
+## Decision
+
+KNELSecretsManager ships a pure-Go CLI (`cli/cmd/smcli`) implementing the
+Bitwarden/Vaultwarden API client: prelogin (PBKDF2/Argon2id), password grant
+with 2FA (TOTP), key derivation + decryption (stretched master key, user
+sym key), sync, item create/edit/delete with hidden fields.
+
+The upstream Rust `bw` binary is RETIRED: bin/ scripts moved to
+archive/rust-bw-era/. The CLI ships in our own container
+(golang build -> alpine runtime, CA certs, non-root), delivered as the
+always-hot compose service `ukrrs-secretsmgr-cli` and the lane shim
+`.tools/sm`.
+
+## Consequences
+
+- No Rust/Node supply chain in the secrets tooling; Go module set is
+  stdlib + golang.org/x/crypto.
+- Vault account bootstrapping (password + TOTP) happens via docker exec
+  from the TSGCOO env file; the container env_file holds non-secret config.
+- Rotation waves (#829) rewire consumers from `bwlane.sh`/`.creds` to `sm`.