Add second-machine onboarding as a first-class verb rather than a manual
clone + key-copy sequence:
- secrets join --remote <url> --key <path>: clone the vault, install the key
at mode 600, then decrypt-test it before declaring success. An empty vault
reports "nothing to verify yet" (never a false VERIFIED); a wrong key fails
loudly. Reuses the audited core (resolve_store, get_pubkey, _verify_all) —
no security logic re-implemented.
- secrets init --remote <url>: wire the remote and push the initial store so
the upstream branch exists (fixes the commit_and_push_secrets pull --ff-only
die against a brand-new empty remote). init also offers an interactive
first-add of a project (default No; skipped under --yes / non-interactive).
- cmd_push first-manifest scaffold writes an explicit committed options.autoAdd
value, asked once when interactive (EGB-677 contract #2).
- secrets pull now dies loudly when a blob fails to decrypt (all three decrypt
paths) instead of warning and exiting 0 — a wrong key can't pass silently.
- Interactive prompts gate on stdin AND stdout being ttys, so bats/CI never hang.
- Dispatcher routes init/join args correctly; second-machine trap points at join.
Tests: 20 new (join, autoAdd, pty-no-hang regression); 2 trap tests updated.
