Add vault payment commands

[rgarcia]

Summary

Add a project-scoped vault CLI for preparing and observing payment credentials. Commands use the generated SDK and existing Cobra, project selection, table/JSON, and confirmation conventions. They do not submit merchant payments.

Command surface

• vaults create --name, vaults list --limit --offset, vaults get <vault>, vaults delete <vault> --yes
• vaults wallets create <vault> <key> --provider link|agentcard [--user-id] [--open]
• vaults wallets payment-methods <vault> <key>
• vaults cards create|update <vault> <key> --provider --wallet --amount --currency --merchant
  • Link also requires --payment-method-id, --merchant-url, --context, and exactly one of --test / --live.
  • AgentCard optionally accepts --card-id. Its mode is deployment-controlled; no per-item test/live flags are accepted.
• vaults cards authorize <vault> <key> [--open]
• vaults items list <vault>, vaults items get <vault> <key> [--wait 0..60] [--expand payment_methods] [--open]
• vaults items events <vault> <key> [--after <event-id>] [--wait 0..60], vaults items delete <vault> <key> --yes
• browsers create --vault <id-or-name> (repeatable, max 20; incompatible with pools even with --yes)

Project selection is optional for all vault commands and browser vault attachment. Use --project or KERNEL_PROJECT to select one; otherwise, the API resolves scope from the credentials and its defaults (the default project for org-wide credentials, not all projects). The API assigns immutable ownership from that scope; there is no project_id body field. Vault names and item keys remain immutable. All non-delete vault commands support -o json.

Safety and output

• No implicit Link authorization. Explicit authorization reads the item first and requires both requested state and advertised authorize; the SDK's automatic retries are disabled for every vault request. Pending authorization recovery is deliberately not exposed.
• Waits are single bounded server-side observations. They do not retry payments or promise readiness. Human output distinguishes credential readiness, approval actions, checkout authorization state, charged amounts, and response delivery.
• Show only API-returned aliases and permitted domains. Permitted domains are provider-assigned; this API has no domain-setting operation. Action and approval URLs print in full on separate lines outside truncating tables. Returned HTTPS actions may be opened explicitly; no OAuth-code callback command or card-data input exists.
• JSON uses an allowlisted public-field projection, preserving field presence and omitting unknown/opaque provider data. Event output retains known sanitized outcome fields, not provider bodies. Credential-bearing action URLs are withheld. API errors use the standard CLI formatter, preserving the API code/message and underlying SDK error; no vault-specific error-body suppression or generic payment advice is added. Vault and vault-item deletes treat HTTP 404 as success and print Deleted or not found, whether the missing object is the project, vault, or item. Non-404 errors still propagate.
• README/help describe the complete workflow and prohibit retrying failed, timed-out, rejected, or indeterminate payments.

Temporary SDK dependency

One go.mod replacement pins the canonical SDK import to:

github.com/kernel/kernel-go-sdk-staging v0.86.1-0.20260904020633-50f33b1b5cf6

This resolves to commit 50f33b1b5cf6bea9f2e34b44de8d52af0e80a6f4 on stlc/preview/pr-3698. The pseudo-version was resolved through Go, and go.sum records its checksums. The canonical require remains unchanged; no SDK files or branches were modified.

For local builds, authenticate GitHub access to the staging repository and set GOPRIVATE=github.com/kernel/kernel-go-sdk-staging. CI temporarily uses the existing GitHub App credentials to mint a contents-read token scoped only to the preview repository. Go caching is disabled so the private SDK source is not published through public CI caches. Fork CI cannot access this private preview.

The preview also renames nine existing browser SDK path fields from ID to IDOrName; the corresponding call sites are updated without changing command behavior.

Required after the SDK release, before publishing the CLI

1. Remove the replacement with go mod edit -dropreplace=github.com/kernel/kernel-go-sdk.
2. Upgrade the canonical SDK to the release containing these APIs and run go mod tidy.
3. Remove the preview-token/GOPRIVATE setup from the test workflow and restore Go caching.
4. Re-run tests, build, and lint against the released SDK. Confirm the API is deployed/enabled before exercising the commands.

Deliberate limits

Advanced optional Link line items, totals, metadata, and expiry are not configurable in this initial surface. cards update is explicitly documented as full-spec replacement: omitted optional details previously set through another client are removed. There are no rename, domain-setting, raw request, callback-code, payment submission, or automatic payment retry commands. Browser vault bindings are creation-only; pool acquisition and existing-browser attachment are not exposed.

Verification

Current CI blocker: dependency resolution fails with unknown revision 50f33b1b5cf6 for the pinned preview SDK, including after a rerun. The local checks below passed using the cached pinned SDK. The pin is unchanged; CI must be restored before merging.

• make test passed (go vet ./... and go test ./...).
• make build passed.
• Focused vault/browser tests passed with -race.
• make lint ran with golangci-lint 2.5.0 built using Go 1.25.0: 66 findings in existing code, including SDK deprecations; golangci-lint run --new-from-rev=main reports 0 issues. The Makefile masks lint exit status, so the incremental check was also run directly.
• Tests cover command construction, invalid/required flags, optional project selection across every vault command and browser attachment, explicit project headers, pagination hints with and without project selection, typed request mapping, no implicit authorization/retries, JSON and plain-text API errors, invalid project names/IDs across all vault commands, bounded waits/cancellation, cursors, delete prompts and 204/404 success versus 403/409/500 errors, human/JSON output, alias presence/redaction, advisory capabilities, explicit URL opening, and browser attachment/pool conflicts.
• Long action/approval URL regression tests verify standalone full URLs and unchanged JSON values. Verified the built CLI in 40-, 80-, and 120-column pseudo-terminals against local HTTP fixtures: all six checks preserved the complete URL.
• Full diff self-review/deslop and incremental complexity checks completed.
• Compared the built CLI against a local invalid-project HTTP fixture: vault/browser/profile/project lists and project deletes surface the API error with exit 1. Existing browser/profile deletes swallow 404s and exit 0; those unrelated handlers remain unchanged. Vault and vault-item deletes likewise exit 0 with Deleted or not found; rechecked both delete commands and the unchanged failing list command against a local invalid-project fixture.
• Only local HTTP fixtures and fake services were used. No live Kernel/provider calls, credentials, browser sessions, or payments were used for testing.