feat: vault core/CLI/workbench, vaultd token path, filetree view-state cleanup

Land password-vault dedicated workbench and mnote-vault-core/CLI, agent token
read path design, vault transport split, and retire obsolete filetree smokes.
Ignore local vault reimport scripts that trip secret scanners.

.gitignore

@@ -28,6 +28,7 @@ env-archive/
 /.reasonix/
 /.codegraph/
 /.pi/
+/.serena/
 /tmp-block-handle-qa.js
 
 # Retired root-level agent/harness/browser evidence artifacts.
@@ -112,3 +113,6 @@ design/05-editor-mainline/reference-code
 # 下载的 Wolai 静态页面参考包，不作为可维护设计稿入库
 design/design/html/
 recycle
+
+# 本地一次性 vault 源数据重导入脚本（含 password frontmatter 探测字面量，ECC 误报；不入库）
+/scripts/vault-reimport-*.py