fix(vault-kms): pass pubkey response via tmpfile not string literal

Embedding $response as Python triple-quoted string caused json.loads()
to fail with 'Invalid control character' when Vault's JSON contained
\n sequences in the PEM public key (bash \n → Python newline → invalid
JSON control char).

Fix: write response to mktemp, pass path as argv, read with open().

AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh

@@ -106,11 +106,14 @@ vault_kms_pubkey() {
       echo "vault-kms: pubkey fetch failed (key=$key)" >&2; exit 1
     }
 
-  python3 - "$output" <<PY
+  local tmp_resp
+  tmp_resp=$(mktemp)
+  printf '%s' "$response" > "$tmp_resp"
+  python3 - "$output" "$tmp_resp" <<'PY'
 import sys, json
 output = sys.argv[1]
-response = """$response"""
+with open(sys.argv[2]) as f:
-d = json.loads(response)
+    d = json.loads(f.read())
 keys = d["data"]["keys"]
 # keys is a dict; pick the latest version
 latest = max(keys.keys(), key=lambda k: int(k))
@@ -119,6 +122,7 @@ with open(output, "w") as f:
     f.write(pub if pub.endswith("\n") else pub + "\n")
 print(f"vault-kms: public key written to {output}", file=sys.stderr)
 PY
+  rm -f "$tmp_resp"
 }
 
 # ── Verify a signature ────────────────────────────────────────────────────