- daemon.rs: provision_tenant_env() — looks up tenant, calls colibri-vault,
marks tenant active on success
- socket.rs: extract jail info before spawn, fire provision hook after
agent insert (fire-and-forget via tokio::spawn)
- colibri-vault dep added to colibri-daemon Cargo.toml
After jail creation, if a tenant record matches the jail name, the hook
fetches the Vaultwarden collection and writes a 0600 .env into the jail
root before the agent starts. HIVE steps 1-3 complete.