Provision the E2E memory secret into the local vault

`nap gateway vault setup` unwraps the project memory secret once (prompt
on a terminal, or the existing argument/env paths) and stores the
secret, never the passphrase, in memory-secrets.vault.json under the
existing 0600 local vault key. The CLI and MCP workers load it
automatically and MCP never prompts, per
/decisions/local-gateway-no-interactive-unlock and
/decisions/2026-09-29-memory-secret-local-vault. Older versions stay
readable; a rotated active version reports memory_secret_rotated with
the setup next action. `vault forget` revokes local access, including
for running workers. Env passphrases still work, are persisted into the
vault, and are reported as deprecated. Search warns
e2e_index_not_provisioned instead of e2e_index_locked. Local key
creation is 0600 from the start and never replaces a published key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/test_mcp_memory_node_encryption.py

@@ -116,6 +116,8 @@ def run():
     mod = load_module()
     test_state = tempfile.TemporaryDirectory()
     mod.AUTH_PATH = pathlib.Path(test_state.name) / "auth.json"
+    mod.MEMORY_SECRET_VAULT_PATH = pathlib.Path(test_state.name) / "memory-secrets.vault.json"
+    mod.LOCAL_VAULT_KEY_PATH = pathlib.Path(test_state.name) / "vault.local-key"
     mod.AUTH = {"account_id": ACCOUNT_ID, "token": "token", "token_expires_at": "later"}
     mod.PROJECT_VAULT_PASSPHRASE = PASSPHRASE
     mod.DEFAULT_PROJECT_ID = "project-1"
@@ -485,9 +487,11 @@ def run():
         mod.MEMORY_SECRET_CACHE.clear()
         mod.ACTIVE_MEMORY_SECRET_VERSIONS.clear()
         mod.PROJECT_VAULT_PASSPHRASE = None
+        # Earlier passphrase unwraps persisted the secret locally; remove it.
+        mod.memory_secret_vault_forget("project-1")
         locked = mod.search_local_index({"q": "needle", "limit": 5})
         assert locked["items"] == []
-        assert [warning["code"] for warning in locked["warnings"]] == ["e2e_index_locked"]
+        assert [warning["code"] for warning in locked["warnings"]] == ["e2e_index_not_provisioned"]
 
     print("ok: local MCP memory node encryption smoke passed")