Initialize ops repository

vault/README.md

@@ -0,0 +1,12 @@
+# Vault (encrypted-only)
+
+This directory contains **encrypted artifacts only**.
+
+Rules:
+
+- Never commit plaintext secrets (even temporarily).
+- Never commit private keys.
+- Treat `vault/` as safe-to-leak ciphertext: if leaking it would break you, it is mis-scoped.
+
+Decryption/working material belongs in `vault/tmp/` (gitignored) and should be wiped after use.
+