[patch] Harden Vault initialization durability

[pennypacker-he]

Summary

• make Vault initialization durable with create-only GCS recovery persistence, bounded retries, and KMS/storage preflight checks
• prevent metadata and redirect token leakage, run the production image as non-root, and exercise failure/retry behavior
• align release publication with the shared signed GHCR + GAR workflow and add native amd64/arm64 image scans
• refresh Google Cloud dependencies after verifying no called vulnerabilities

Validation

• go test -race ./...
• go mod tidy -diff
• govulncheck ./...
• actionlint
• publication contract tests

Release order

Merge only after this exact head passes hosted CI. The resulting 1.0.2 tag and signed GHCR/GAR images must publish successfully before the API bundle pins its digest.