[major] Harden the Vault proxy boundary

[libops-agent]

Summary

• replace ambiguous prefix allowlisting with validated exact, single-segment, and final-subtree route patterns
• fail closed on malformed configuration and strip privileged proxy credentials before forwarding
• test the authorization boundary and publish signed multi-architecture images to GHCR and GAR through the shared LibOps workflow

Validation

• go test -race ./...
• go mod tidy -diff
• actionlint .github/workflows/*.yaml

Dependency

This release must land before the API Vault module starts emitting version-2 route patterns.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 66.01307% with 52 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
main.go	66.01%	44 Missing and 8 partials ⚠️

Files with missing lines	Coverage Δ
main.go	68.36% <66.01%> (+12.36%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.