New-DevloreKeyVaults becomes a star devlore command, so one implementation serves every platform #861

Feature: #475 — The base layer in noblefactor-ops. Ruled 2026-09-07: "Short-term: do the move. Longer-term:
port to star." The move is #476; this is the port.

Why

New-DevloreKeyVaults is sixty lines of az calls in a loop over dev, stg, prd: a resource group, a
Key Vault with RBAC, a Key Vault Administrator assignment for the signed-in user. As a bash script it runs
where bash runs and would need a PowerShell twin for Windows. As a star command it runs wherever star and
az do, once. The standing ruling (2026-09-04) is extensions over script moves, moving only when the port
is blocked; #476 moved it because the port waits on one thing below.

The command

star devlore keyvault create [--environment dev|stg|prd|all] in a new extension beside the five
com.noblefactor.devlore.* trees, following star <service> <resource> <verb>. It narrates each step the
script notes today and reports the vault URIs as its result, rendered by -o like every other command.
Idempotent as the script is: an existing group, vault or assignment is reported, not recreated.

What it waits on

shell.exec is sh -c today and raises on any non-zero exit (#824). The port needs a command execution
that reaches az on Windows without a bash and lets az keyvault show fail as a probe — the shell
provider rewrite noblefactor-ops#151 also waits on, or the powershell provider (pwsh, cross-platform)
as the carrier. Whichever lands first, the port uses it.

Acceptance

• star devlore keyvault create --environment all on macOS, Ubuntu and Windows produces what the
  script produces, and a second run changes nothing
• the bash script and its man page and completions leave Home/noblefactor-ops.Unix; devlore-cli
  deploys no bash script
• the extension passes buildifier and its docstrings; the command is in the tree documentation

Related

#476 (the move this supersedes), noblefactor-ops#151 (the shell provider rewrite), #824 (shell.exec
raises on non-zero), noblefactor-ops#140 (the first extension shipped by a layer, the pattern to follow).