CLI compatibility manifest

The public v1 CLI surface is now frozen. Long-form commands are canonical. --machine output is contract. Exit codes are contract. Human output is not.

What this means: documented command names, long-form flags, exit-code semantics, and --machine key names will not change within the same major version. Scripts written today against vault put, vault get --stdout, vault verify, and the rest of the documented surface will continue to work. New optional flags and commands may be added; nothing existing will be removed or renamed silently.

vault config set-token is deprecated in favour of vault config set token. The old form still works and will until a major version.