Simplify sender to Vault only

[awei-cefai]

Summary

• Makes the send action Vault-only.
• Removes legacy WALLET_URI / workspace / stream mode.
• Removes central sender mode and sender_mode routing.
• Publishes github_event directly to a Vault AgentConnection with @cef-ai/vault-sdk.
• Keeps only the required Vault payload shaping, target resolution, wallet loading, and Polkadot warning filter.
• Deletes package-lock.json and installs with npm install --no-package-lock --omit=dev so the PR is not dominated by lockfile churn.

Minimum caller setup

• CEF_VAULT_WALLET_KEYSTORE_B64 secret
• CEF_VAULT_WALLET_KEYSTORE_PASSWORD secret
• Optional but recommended: CEF_AGENT_ID variable

The test Vault endpoints, scope, default agent alias, and cubby alias are now action defaults and can still be overridden with CEF_* env vars.

Validation

• node --check index.mjs
• ruby -e 'require "yaml"; YAML.load_file("action.yml")'
• npm install --no-package-lock --omit=dev --prefix .
• git diff --check
• Missing-wallet smoke fails with the expected Vault wallet error and zero Polkadot duplicate-version warning lines.
• Real local Vault publish accepted event 019e49ec-caff-7739-8d6d-a00256bcee48.
• Verified the local publish was processed into productivity_store as repo CEF-AI/action-vault-only-smoke, action branch_push.
• Fresh GitHub workflow run 26218604344 downloaded this action at SHA 58d533bee42de19e25f53d0c6f2fe1e4c3c91843, published successfully, and had zero unexpected-input or Polkadot duplicate-version warning lines.
• Verified workflow delivery 26218604344-1 in productivity_store as repo CEF-AI/Productivity-Engineering-Intelligence, action branch_push, entry Pushed to awei/test-vault-sender-20260517124220: Retest simplified Vault tracker.