Add unlock --idle, and packaging/repo.sh for repo.dixon.cx

vault unlock --idle counts the duration from the last command that used
the key rather than from the unlock: the agent resets its timer each
time it hands the key out. The agent loop no longer needs its own
goroutine.

packaging/repo.sh builds the dixon-vault .deb, .rpm and Arch packages
from a release tag (a clean git archive) with nfpm for amd64, arm64,
armv7, 386 and riscv64, then publishes them to the apt, dnf and pacman
repositories at repo.dixon.cx: apt-ftparchive with a signed InRelease,
createrepo_c (in a Fedora container) with signed RPMs and repomd.xml,
and repo-add (in an Arch container) with signed packages and database.
Indexes cover every package in the repository, under a lock, so other
projects publishing with their copy of the script are kept. The package
is dixon-vault because vault is HashiCorp Vault in Arch's [extra] and
HashiCorp's own repositories; it conflicts with vault.

README, guide and CLAUDE.md point at the repository.

CLAUDE.md

@@ -15,8 +15,9 @@ root that builds a single `vault` binary. Module `github.com/andydixon/vault`.
   folder, asks unless `-f`), `unlock`/`lock`.
 - `agent*.go` - `vault unlock` re-executes itself as a hidden `__agent`
   process holding the suite ID and seed (pipe in, mlocked, undumpable) and
-  serving them on a Unix socket in a 0700 per-user dir until a hard
-  deadline. `keyIdentity` asks it first unless `$VAULT_PASSPHRASE` is set.
+  serving them on a Unix socket in a 0700 per-user dir until a deadline
+  (fixed, or with `--idle` reset on each use). `keyIdentity` asks it first
+  unless `$VAULT_PASSPHRASE` is set.
 - `keyfile.go` - key file with two passphrase slots (Argon2id +
   XChaCha20-Poly1305 sealing a suite ID and 32-byte master seed). The second
   slot is either a decoy identity or random bytes; slot order is random.
@@ -30,6 +31,9 @@ root that builds a single `vault` binary. Module `github.com/andydixon/vault`.
   readers shared, taken after the passphrase prompt.
 - `docs/guide` - LaTeX user guide (`build-pdf.sh` via Tectonic; `shots.py`
   re-shoots screenshots from the real binary). Keep it in step with the CLI.
+- `packaging/repo.sh [TAG]` - builds dixon-vault .deb/.rpm/Arch packages
+  from a tag with nfpm and publishes them, signed, to the apt/dnf/pacman
+  repo at repo.dixon.cx (same script, other project block, in ../mapsize).
 - `build.sh` - cross-compiles every `go tool dist list` target except
   iOS and android/386, amd64, arm (cgo-only).
 - `internal/pqcrypt` - file encryption (header + STREAM ChaCha20-Poly1305),