Add Vault auto-unseal service and 1Password bootstrap script

Add vault-tpm2-unseal.sh/.service to unseal Vault once after boot using
the TPM-sealed key, and tpm-bootstrap-1password.sh to (re)seal that key
from a 1Password secret reference. Document PCR policy selection, the
Vault service, and the host-specific tpm2.env (gitignored, example in
README) in README.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

vault-tpm2-unseal.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# Unseal a HashiCorp Vault instance using a password sealed into the TPM 2.0
+# with tpm-seal-password.sh. Intended to run once, after vault.service has
+# started, via vault-tpm2-unseal.service.
+# Configuration is read from environment variables, normally supplied by
+# systemd's EnvironmentFile= from /etc/vault.d/tpm2.env:
+#   VAULT_ADDR         Vault API address (required)
+#   TPM_UNSEAL_SCRIPT   Path to tpm-unseal-password.sh (default: /usr/local/sbin/tpm-unseal-password.sh)
+#   TPM_HANDLE          Persistent TPM handle the key was sealed at (default: 0x81010001)
+#   TPM_PCR_LIST        PCR bank/indices the key was bound to (default: sha256:7)
+
+set -euo pipefail
+
+: "${VAULT_ADDR:?VAULT_ADDR must be set}"
+TPM_UNSEAL_SCRIPT="${TPM_UNSEAL_SCRIPT:-/usr/local/sbin/tpm-unseal-password.sh}"
+TPM_HANDLE="${TPM_HANDLE:-0x81010001}"
+TPM_PCR_LIST="${TPM_PCR_LIST:-sha256:7}"
+
+command -v vault >/dev/null || {
+	echo "vault CLI not found in PATH" >&2
+	exit 1
+}
+
+[ -x "$TPM_UNSEAL_SCRIPT" ] || {
+	echo "${TPM_UNSEAL_SCRIPT} not found or not executable" >&2
+	exit 1
+}
+
+set +e
+vault status -address="$VAULT_ADDR" >/dev/null
+STATUS=$?
+set -e
+
+case "$STATUS" in
+0)
+	echo "Vault at ${VAULT_ADDR} is already unsealed"
+	exit 0
+	;;
+2)
+	;;
+*)
+	echo "vault status against ${VAULT_ADDR} failed (exit ${STATUS})" >&2
+	exit 1
+	;;
+esac
+
+KEY=$("$TPM_UNSEAL_SCRIPT" -H "$TPM_HANDLE" -l "$TPM_PCR_LIST")
+
+vault operator unseal -address="$VAULT_ADDR" "$KEY" >/dev/null
+
+unset KEY
+
+echo "Vault at ${VAULT_ADDR} unsealed via TPM handle ${TPM_HANDLE}"