feat: switch execute to orchestrator API, add secret command

[AlephNotation]

Summary

Switches vers execute from direct SSH to the orchestrator's exec streaming API, and adds a new vers secret command for managing sensitive environment variables.

Execute via orchestrator API

vers execute now uses POST /api/v1/vm/{id}/exec/stream by default. Commands flow through the vsock agent inside the VM, which means they automatically inherit /etc/environment (secrets and env vars).

vers execute <vm> ls -la /
vers execute <vm> echo $ANTHROPIC_API_KEY
vers execute --ssh <vm> echo "legacy path"   # direct SSH fallback
vers execute -w /app <vm> npm start           # working directory support

Key changes:

• Streams NDJSON output (stdout/stderr) in real time
• Propagates remote exit codes to the CLI process
• --ssh flag preserves legacy SSH behavior
• SetInterspersed(false) so command flags like -la pass through correctly
• --workdir / -w for remote working directory

vers secret command

New command for managing sensitive values with security-conscious UX. Uses the same /api/v1/env_vars backend — no API changes needed.

vers secret set ANTHROPIC_API_KEY              # prompts with hidden input
vers secret set DATABASE_URL postgres://...     # inline value
echo "sk-ant-..." | vers secret set API_KEY     # piped stdin
vers secret list                                # masked: sk-a****yz
vers secret list --reveal                       # full values
vers secret delete OLD_TOKEN

Differences from vers env:

	vers env	vers secret
Value input	Required inline arg	Optional — hidden prompt if omitted
List output	Full values	Masked unless --reveal
Shell history	Value visible	Value never in history

Files changed

File	Change
cmd/execute.go	API by default, --ssh fallback, --workdir, flag passthrough
internal/handlers/execute.go	Dual path: API streaming + SSH fallback
internal/services/vm/exec.go	New — orchestrator exec stream client
internal/presenters/execute_types.go	Added ExitCode to view
cmd/secret.go	New — vers secret set/list/delete
cmd/secret_test.go	Masking tests
cmd/env.go	Cross-reference to vers secret in help

Context

Part of the virtual secrets work (design doc). Routing exec through the orchestrator API ensures secrets in /etc/environment are visible to all commands, and sets up the foundation for cross-account secret isolation on the backend.