Initialize OneCLI Agent Vault

This skill installs OneCLI, configures the Agent Vault gateway, and migrates any existing .env credentials into it. Run this after /update-nanoclaw introduces OneCLI as a breaking change, or any time OneCLI needs to be set up from scratch.

Principle: When something is broken or missing, fix it. Don't tell the user to go fix it themselves unless it genuinely requires their manual action (e.g. pasting a token).

Phase 1: Pre-flight

Check if OneCLI is already working

onecli version 2>/dev/null

If the command succeeds, OneCLI is installed, check for an Anthropic secret:

onecli secrets list