fix(secondbrain): use canonical vault resolver for onboarding

[levineam]

Motivation

• The detect-vault.js helper duplicated vault-path resolution logic and hard-coded ~/Documents/Vault v3, diverging from the hardened resolver and risking guidance that points runtimes/users at stale or incorrect vaults.
• Onboarding guidance and the --json machine output were emitted before applying existence and stale-path guardrails, allowing consumers to treat invalid paths as usable.

Description

• Replaced the ad-hoc resolver in modules/jarvos-secondbrain/scripts/detect-vault.js with the canonical resolver by importing resolveConfig() and discoverConfigPath() from the bridge config so onboarding uses the same fail-closed guardrails.
• Hardened JSON mode so the script checks the resolved vault exists and exits nonzero (2) instead of emitting a JSON payload for nonexistent/stale vaults.
• Added automated tests at modules/jarvos-secondbrain/tests/detect-vault.test.js that cover canonical selection, JSON-mode rejection of nonexistent vaults, and rejecting an explicitly configured stale ~/Documents/Vault v3.
• Updated Hermes skill docs runtimes/hermes/skills/jarvos/SKILL.md to refer to the canonical ~/Vaults/Vault v3 default and instruct callers to run the validated detector rather than assuming ~/Documents/Vault v3.

Testing

• Ran node --test tests/detect-vault.test.js tests/config-resolution.test.js and the added/related tests passed (detect-vault tests and config-resolution tests succeeded).
• Ran the package test suite with npm test, where the secondbrain tests mostly passed: the run reported 417/420 tests passing and 3 pre-existing unrelated failures in other tests.
• Verified the changed detector script emits no JSON for nonexistent vaults and returns the expected nonzero status in the JSON path, and that the new tests exercise the canonical resolver behavior successfully.

---

Codex Task