TS port slice 4: portable backup, CI, and the agent-blind CLI MVP

- Portable backup (format_version 1): TS imports Python exports, re-exports
  byte-identically under pinned nonce/timestamp, verifies the canonical
  checksum, rejects tampering and unknown versions.
- .github/workflows/ts-parity.yml: typecheck + Node/jsdom parity suite on
  js/ changes, plus a fixture-drift job that regenerates fixtures from
  Python and fails if the committed ones don't match (manifest commit field
  excluded by construction).
- packages/cli — seedpass-js MVP implementing plan section 9.3:
  * reference-first output: entry list/get/search emit sp://entry/<id> refs
    and metadata; secret-bearing fields become has_* flags
  * 'entry reveal' is the only plaintext egress command
  * 'use --clipboard|--exec|--stdin-to' delivers secrets to sinks; --exec
    injects SEEDPASS_SECRET into the child env, never argv or stdout
  * vault export/import over portable backups; capabilities --format json
  * mnemonic comes from SEEDPASS_MNEMONIC env, never the command line
- CLI tests prove the blindness properties: derived password matches the v2
  fixture, TOTP at pinned time, secrets absent from all default output and
  from sink-delivery confirmations.
- 125 core parity tests (Node + jsdom) + 11 CLI tests green.

Co-Authored-By: Claude Fable 5 <[email protected]>

.github/workflows/ts-parity.yml

@@ -0,0 +1,60 @@
+name: TypeScript Parity
+
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - "js/**"
+      - "scripts/generate_ts_port_fixtures.py"
+      - ".github/workflows/ts-parity.yml"
+  pull_request:
+    branches: ["**"]
+    paths:
+      - "js/**"
+      - "scripts/generate_ts_port_fixtures.py"
+      - ".github/workflows/ts-parity.yml"
+
+jobs:
+  parity:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: js
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Enable pnpm via corepack
+        run: corepack enable
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm -r typecheck
+      - name: Parity tests (Node + jsdom)
+        run: pnpm -r test
+
+  # The fixtures are committed, so the parity job never regenerates them.
+  # This job proves the committed fixtures actually come from the committed
+  # generator: it regenerates from Python and fails on any drift.
+  fixture-drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install Poetry
+        run: pipx install poetry
+      - name: Install dependencies
+        run: poetry install --no-interaction --no-ansi
+      - name: Regenerate fixtures
+        run: poetry run python scripts/generate_ts_port_fixtures.py
+      - name: Fail on drift
+        # manifest.json records the generating commit, which legitimately
+        # differs from the checked-out commit — everything else must match.
+        run: >
+          git diff --exit-code --
+          js/packages/test-vectors/fixtures
+          ':(exclude)js/packages/test-vectors/fixtures/manifest.json'