Bounded Residency: targeted vault lookup

[flyingrobots]

Parent Goalpost

• v6.1.0: Bounded Residency #38

Work

Add RED tests proving single vault entry lookup uses targeted tree-entry reads when available and fails the test if whole-tree readTree() is called.

Expected Proof

• Focused vault persistence/service test that fails before implementation.
• Implementation keeps fallback behavior explicit for adapters without targeted reads.

[flyingrobots]

Resolved on origin/main at beb8a29.

VaultService.resolveVaultEntry delegates the requested slug to a single persisted-entry read: src/domain/services/VaultService.js#860beb8a29. VaultPersistence.readEntry prefers readTreeEntry and retains an explicit whole-tree compatibility fallback when that targeted capability is unavailable: src/domain/services/VaultPersistence.js#134beb8a29 and src/domain/services/VaultPersistence.js#139beb8a29.

The focused regression makes readTree fail, verifies the targeted call, and verifies that the whole tree was never read: test/unit/vault/VaultService.test.js#650beb8a29, test/unit/vault/VaultService.test.js#669beb8a29, and test/unit/vault/VaultService.test.js#670beb8a29.

The focused audit and the complete unit suite pass on the cited SHA. Closing as already implemented and covered.