Vault ecosystem auto-setup on first activate (personal + public vault, mounts.toml)

[aarontrowbridge]

Follow-up to #307 (armonia workspace). New Marketplace users should get a working vault ecosystem with zero commands.

Acceptance Criteria

• ensureVaultEcosystem() in vault_setup.ts — idempotent, never throws: ensures ~/armonia/data dirs + symlinks, ensures personal vault (no-op if exists), ensures public vault vault-public (shallow clone of harmoniqs/vault-public with 10s cap, placeholder if offline/no-git), ensures ~/.amico/mounts.toml absent-only (personal rw first, public ro second)
• extension.ts calls it before prepareOpencodeProject on every activate (replaces personal-only path)
• trees.ts renders mount stack instead of static "run Set up a vault" placeholder
• tools/bootstrap-armonia.sh mirrors the same three steps as idempotent block (CLI/extension order agnostic)
• skills/amico-vault/SKILL.md updated: vault-* naming in kinds table, new First-run lifecycle subsection for vault-public (kind="public", ro)
• Fresh VM verification: rm -rf ~/.amico ~/armonia && install + open → personal + public present, mounts.toml written, second activate no-op, offline degrades to placeholder