feat(vault): clipboard.backend selection (auto / arboard / osc52)

[UnbreakableMJ]

What

New clipboard.backend config key (PRD §7.1) choosing how the TUI's copy keys
reach a clipboard:

• auto (default, = today): the agent uses its native backend (arboard:
  Wayland / X11 / macOS); if none is reachable it declines and the TUI falls
  back to OSC52.
• arboard: force the native backend (warns if unavailable).
• osc52: the agent uses no native backend and declines, so the TUI
  copies through the terminal via an OSC52 escape. Use this over SSH/tmux so
  copies land on your local machine.

Why osc52 works this way

The agent is a detached daemon with no terminal, so it can't emit OSC52 itself
(established in clipboard.rs). The TUI already does client-side OSC52 when the
agent returns ClipboardUnavailable (vault-tui/src/osc52.rs). osc52 simply
makes the agent decline on demand so that existing path runs — previously you
couldn't force it when the agent's box happened to have a (wrong, headless-X)
clipboard. Only the TUI sends Copy/CopyText (the CLI has no copy verb), so
this cleanly scopes to TUI copies.

How

• vault-config: clipboard.backend validated to auto/arboard/osc52
  → --clipboard-backend auto-spawn flag (same plumbing as the other keys).
• vault-agent: clipboard::BackendChoice + select() wrapping the
  existing detect(). The --clipboard-backend flag is defined
  unconditionally, so a headless agent (--no-default-features) still
  accepts it as a no-op. vault status reports osc52 even when no native
  backend is held.

Tests

• vault-config: validation (rejects e.g. xclip), lower-casing, toml
  round-trip, agent_args flag emission.
• vault-agent: BackendChoice as_str/default; select(Osc52) is None
  (CI-safe — no clipboard touch); a Status test for the osc52-mode label;
  existing fake-backend / headless Status assertions unchanged.

Local CI-exact gates all green: fmt, fresh isolated clippy -D warnings,
cargo test --workspace --all-targets under RUSTFLAGS=-D warnings,
cargo deny check (no new deps), both headless builds (agent still accepts
--clipboard-backend).

🤖 Generated with Claude Code