fix(cli): keep updated install vault encrypted

[NautiluX]

Summary

• keep prod.vault.yaml SOPS-encrypted after oms update install-config
• centralize encrypted vault output in InstallConfigManager and reuse the existing SOPS encryption helper
• route temporary-file creation, writes, permissions, cleanup, and replacement through the FileIO abstraction
• replace the encrypted target only after successful encryption, preserving the original vault on failure
• share --postgres-server interpretation between init and update: primary hostname in install mode, server address in external mode
• update generated command documentation

Tests

• go test ./internal/util ./internal/installer ./internal/installer/vault ./cli/cmd -count=1
• success coverage verifies the updated vault remains encrypted and decryptable
• failure coverage uses in-memory file operations and verifies the original vault is unchanged

ClickUp: https://app.clickup.com/t/24560134/869e71neh

[NautiluX]

this should mention the actual filename, not vault.yaml

[NautiluX]

The shared marshaling error now includes the actual target filename via filepath.Base(vaultPath).