Commits on Sep 21, 2026

docs: add MIRRORING.md, and re-apply the vault-write key check here

Two halves of one omission. The private harness gained a --key routing-prefix check in vault-write; bin/vault-write here kept the old code, which is exactly the drift the mirror procedure exists to prevent and nothing was written down about that procedure in this repo.

docs/MIRRORING.md states the rule -- private is committed first and the mirror is never ahead of it -- and why: sanitizing only ever removes, so a change that lands here first has by definition not been through that pass. It is written for a reader who runs the same split, not as a transcript of one person's setup: no absolute home paths, no hostnames, no internal domain, no reference to tooling that exists only in the private copy.…