[improvement] Next hardening pass for env-vault CI/agent workflows

[ouchanip]

Context

PR #9 made env-vault safer and more agent-friendly: restrictive file modes, overwrite protection, JSON output, stable exit codes, and Codex review fixes.

This issue tracks the next hardening pass for production/team use.

Proposed improvements

• Add stricter key validation

  • Reject non-hex characters in DOTENV_KEY / .env.key, not only wrong length.
  • Return a clear error that does not echo secret material.

• Add a versioned encrypted envelope

  • Current format is iv:authTag:ciphertext.
  • Consider v1:aes-256-gcm:iv:authTag:ciphertext or JSON metadata so future algorithms/formats can be migrated safely.

• Add a non-secret validation command

  • Example: env-vault decrypt --check.
  • It should verify that .env.enc can be decrypted with the available key without printing plaintext.
  • Useful for CI and agents where logs must not contain secrets.

• Add stale-encryption detection

  • Example: env-vault encrypt --check-clean or env-vault diff.
  • Goal: detect when .env has changed but .env.enc was not regenerated.
  • Avoid printing secret values; compare hashes/metadata only.

• Review dependency/security hygiene

  • npm audit currently reports dev-dependency findings after npm ci.
  • Decide whether to update Jest/ESLint stack or document that runtime dependency surface is intentionally small.

Acceptance criteria

• New behavior is covered by unit/E2E tests.
• CI/agent workflows can validate encrypted env files without exposing plaintext.
• Backward compatibility with existing .env.enc files is either preserved or a migration path is documented.