- replace `rw vault ssh` calls with `rwagent.Client` in PrepareNodeKeys,
LoadAgentKeys, EnsureVaultEntry, ResolveVaultPublicKey
- add vaultClient interface, newClient func, and wrapAgentError for
testability and improved error messages
- prefer pre-built systemd dir in installNamespaceTemplates