Adds the runtime-fetch section the seam depends on: item-naming
convention (item name = env var name, value in password field),
the ~/.config/vault-bootstrap.env drop, helper usage and exit-code
semantics. The manual CLI flow remains the floor.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>