CLI, agent and absorb; stop tracking target/

Every Go command with the same flags, prompts and messages; the agent is
wire-compatible with Go's; tests drive the real Rust and Go binaries.

Co-Authored-By: Claude <noreply@anthropic.com>

src/store/tests.rs

@@ -2,48 +2,9 @@
 
 use super::*;
 use crate::crypto::kem::SUITE_ID;
+use crate::testutil::{TempDir, walk};
 use std::sync::atomic::Ordering;
 
-pub(crate) struct TempDir(pub PathBuf);
-
-impl TempDir {
-    pub fn new(tag: &str) -> TempDir {
-        let r: [u8; 8] = crate::rng::os().array();
-        let p = std::env::temp_dir().join(format!("vault-store-{tag}-{}-{}", std::process::id(), hex(&r)));
-        std::fs::create_dir_all(&p).unwrap();
-        TempDir(p)
-    }
-}
-
-impl Drop for TempDir {
-    fn drop(&mut self) {
-        // Read-only test directories must be writable again to delete.
-        #[cfg(unix)]
-        for e in walk(&self.0) {
-            use std::os::unix::fs::PermissionsExt;
-            if e.is_dir() {
-                let _ = std::fs::set_permissions(&e, std::fs::Permissions::from_mode(0o700));
-            }
-        }
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-fn walk(p: &Path) -> Vec<PathBuf> {
-    let mut out = vec![p.to_path_buf()];
-    if let Ok(rd) = std::fs::read_dir(p) {
-        for e in rd.flatten() {
-            let path = e.path();
-            if e.file_type().map(|t| t.is_dir()).unwrap_or(false) {
-                out.extend(walk(&path));
-            } else {
-                out.push(path);
-            }
-        }
-    }
-    out
-}
-
 fn files(p: &Path) -> Vec<PathBuf> {
     let mut v: Vec<_> = walk(p).into_iter().filter(|p| p.is_file()).collect();
     v.sort();