Fix review findings: PAX sizes, agent stdin, PEM parity, sticky writer

- absorb uses the PAX-corrected entry size (large Go/bsdtar archives were
  stored truncated) and refuses GNU sparse entries
- the agent reads the key from fd 0 straight into locked memory, and never
  unlinks a live agent's socket
- the key file PEM parser is a port of Go's pem.Decode
- the STREAM writer fails permanently after a write error; plaintext is
  cleared on reader error paths; AEAD, HMAC and hash states are zeroized
- add/migrate refuse paths inside the vault; publish reports filesystems
  without an atomic no-replace primitive clearly and treats a leftover
  temporary name as a warning; Windows rejects NTFS-special names
- the leak test runs in its own process

Co-Authored-By: Claude <noreply@anthropic.com>

tests/cli.rs

@@ -256,6 +256,15 @@ fn migrate_deletes_only_stored_originals() {
     // Never the vault or the key.
     let o = e.run(RUST, Some(REAL), &["add", "store"]);
     assert!(String::from_utf8_lossy(&o.stderr).contains("is the vault or its key"));
+    // Nor anything inside the vault: migrating its records would delete them.
+    let before = e.names(RUST, REAL);
+    let o = e.run(RUST, Some(REAL), &["migrate", "--yes", "store/records"]);
+    assert!(
+        String::from_utf8_lossy(&o.stderr).contains("is inside the vault"),
+        "{}",
+        String::from_utf8_lossy(&o.stderr)
+    );
+    assert_eq!(e.names(RUST, REAL), before);
 }
 
 #[cfg(unix)]