Vault previously stored UTF-8 text only. Add set-file/get-file so it can
hold files (global .env, *.pem, service-account JSON, Telethon .session):
read bytes -> base64 -> stored under keys[key], marked in binary_keys;
get-file writes raw bytes back (chmod 600). Plain get on a binary key
refuses and points to get-file; list shows <binary>. Backward-compatible.

- credentials-management pack: document set-file/get-file + Telethon
  StringSession-over-file guidance.
- README: refresh skills (16, +/curate-kb /secrets, /research->/research-kb),
  packs (13, +credentials-management), KB verification-governance blurb.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>