Provision the E2E memory secret into the local vault

`nap gateway vault setup` unwraps the project memory secret once (prompt
on a terminal, or the existing argument/env paths) and stores the
secret, never the passphrase, in memory-secrets.vault.json under the
existing 0600 local vault key. The CLI and MCP workers load it
automatically and MCP never prompts, per
/decisions/local-gateway-no-interactive-unlock and
/decisions/2026-09-29-memory-secret-local-vault. Older versions stay
readable; a rotated active version reports memory_secret_rotated with
the setup next action. `vault forget` revokes local access, including
for running workers. Env passphrases still work, are persisted into the
vault, and are reported as deprecated. Search warns
e2e_index_not_provisioned instead of e2e_index_locked. Local key
creation is 0600 from the start and never replaces a published key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/test_cli_dispatch_consolidation.py

@@ -188,6 +188,13 @@ def test_gateway_vault_aliases_rejected():
         expect_unknown(mod, args, "gateway vault action: list")
 
 
+def test_gateway_vault_unlock_verbs_point_to_setup_and_forget():
+    """The memory secret is provisioned once, not unlocked per session."""
+    mod = load_module()
+    for action in ("unlock", "lock", "provision", "remove", "reset"):
+        expect_unknown(mod, ["napseer_mcp_server.py", "gateway", "vault", action], "nap gateway vault setup")
+
+
 def test_gateway_rotate_passphrase_aliases_rejected():
     mod = load_module()
     for args in [