Chunk objects, shard the store, and make filler configurable

File bodies are now cut into 4 MiB objects, the last padded to its
power-of-two bucket, so every object is 64 KiB to 4 MiB whatever the file
size. Object IDs are HMAC'd from a secret per-record seed, so nothing on
disk links a file's pieces, and each object still leads with its own ID,
binding it to its record and position. Chunks are encrypted and synced by
a small worker pool so their fsyncs overlap.

records/ and objects/ are sharded into 256 subdirectories by ID prefix,
all created at init, with every shard's mtime pinned to the epoch.

vault init --filler SIZE writes at least SIZE of filler. Filler entries
are now real entries for a throwaway key, of log-uniform random sizes, so
they carry multi-chunk files like a real collection.

The marker becomes VAULT 2; earlier vaults are not supported.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide/shots.py

@@ -232,7 +232,7 @@ def main():
     t = Term(box)
     t.cmd("vault init")
     t.cmd("ls -A ~/.vault/store/")
-    t.cmd("ls ~/.vault/store/records | wc -l")
+    t.cmd("find ~/.vault/store/records -type f | wc -l")
     shoot("init", t)
 
     t = Term(box)
@@ -261,7 +261,7 @@ def main():
     shoot("mv-rm", t)
 
     t = Term(box, title="sam@laptop: ~/.vault/store")
-    t.cmd("cd .vault/store && ls -l records | head -5", cwd="~/.vault/store", shown="ls -l records | head -5")
+    t.cmd("cd .vault/store && ls -l records/*/* | head -5", cwd="~/.vault/store", shown="ls -l records/*/* | head -5")
     shoot("on-disk", t)
 
     # decoy: fill the decoy side, then show both views side by side
@@ -275,7 +275,7 @@ def main():
 
     t = Term(box)
     t.cmd("vault get ideas/notes.md -o /tmp/x.md", D, highlight=("not in the vault",))
-    t.cmd("ls ~/.vault/store/records | wc -l")
+    t.cmd("find ~/.vault/store/records -type f | wc -l")
     shoot("decoy-hidden", t)
 
     # errors