fix(openbao): stop documenting unseal keys on the command line

deploy.sh's closing banner and README.md both instructed the operator to run
`bao operator unseal -tls-skip-verify <key>`, three times. That places an
unseal key in the docker process's argv, and /proc/<pid>/cmdline is
world-readable -- so every user on the host can read it. Three of those shares
reconstruct the master key, which makes this a worse instance of the leak class
0eb7f26 fixed for the token.

`bao operator unseal` with NO key argument prompts for it with echo suppressed.
Both places now say to pass nothing, and say why.

These lines predate the updater and this session's work; anyone who followed the
printed instructions has been exposing unseal shares to `ps` on that host.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deployments/openbao/README.md

@@ -53,9 +53,13 @@ who connects):
 docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \
   bao operator init -tls-skip-verify           # prints 5 unseal keys + root token
 docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \
-  bao operator unseal -tls-skip-verify <key>   # x3, three different keys
+  bao operator unseal -tls-skip-verify         # x3, prompts hidden each time
 ```
 
+Pass **no key argument** — `unseal` prompts with echo off. A key given on the
+command line lands in the docker process's argv, which `/proc/<pid>/cmdline`
+exposes to every user on the host; three of them reconstruct the master key.
+
 **Store the unseal keys + root token out of band** — ideally age-encrypted with
 your backup recipient (`globals/age-pubkey.txt`), never on this host.
 

deployments/openbao/deploy.sh

@@ -489,7 +489,10 @@ TLS:        ${STACK_DIR}/tls/tls.crt  (give this to the Kanrisha daemon as
      docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \\
        bao operator init -tls-skip-verify
      docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \\
-       bao operator unseal -tls-skip-verify <key>     # x3, three different keys
+       bao operator unseal -tls-skip-verify           # x3, three different keys
+   Pass NO key argument: it then prompts with echo off. A key on the command
+   line lands in the docker process's argv, and /proc/<pid>/cmdline is
+   world-readable -- three of those reconstruct the master key.
 
 2. Bootstrap for Kanrisha. Run the Kanrisha repo's deploy/openbao/bootstrap.sh
    from a host that HAS the 'bao' CLI (the Kanrisha host or your workstation --