Wire vault_adapter to capability-based PermissionGate: VAULT_APPEND for inserts, VAULT_SCHEMA for migrations (T6 only)

Add Vault adapter — SQLite-backed with PermissionGate interface, idempotent INSERT OR IGNORE, audit chain on writes