harness: read Syncro keys from vault, stop hardcoding the repo root

Two defects found while running /wiki-compile, both from tooling assuming
a path instead of resolving it.

1. Plaintext Syncro API keys. Mike's and Howard's live PSA keys were
   copy-pasted into three command files, a script, and two catalog docs --
   despite both already being vaulted at msp-tools/syncro and
   msp-tools/syncro-howard. Replaced with reads from the SOPS vault via a
   new sourced helper, .claude/scripts/syncro-env.sh. Write paths fail
   closed; read-only paths degrade to skipped enrichment rather than a
   wrong key. Per-user mapping is unchanged, so Syncro attribution is too.

2. Hardcoded repo root. wiki-compile/wiki-lint/inject-standards and
   gen_b64.py hardcoded D:/claudetools; this machine is C:/claudetools.
   syncro.md also read ~/.claude/identity.json before the repo copy -- the
   same bug that made remediation-tool's consent-audit report a fully
   consented tenant as RED. Root now resolves from the script's own
   location, with identity.json claudetools_root as the override.

get-identity.sh had a chicken-and-egg bug: it read ${CLAUDETOOLS_ROOT:-.}
but never set it, so every caller had to already know the root. It now
self-resolves and exports CLAUDETOOLS_ROOT + VAULT_ROOT.

Verified: all three command setup blocks authenticate against live Syncro;
get-identity.sh works from any cwd and honors a pre-set root; gps-rmm
autoenroll resolves its key from the vault. security-review: no findings.

NOTE: both keys remain valid in git history. Rotation in the Syncro portal
is the required follow-up -- this commit does not resolve that exposure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/commands/inject-standards.md

@@ -23,7 +23,7 @@ Follow these steps exactly when /inject-standards is invoked:
 
 ### Step 2 — Auto-select relevant standards
 
-1. Read `D:/claudetools/.claude/standards/index.yml`.
+1. Read `.claude/standards/index.yml`.
 2. Review the descriptions for all entries.
 3. Select the 2–5 standards most relevant to either:
    - The task description in $ARGUMENTS, or
@@ -35,7 +35,7 @@ Follow these steps exactly when /inject-standards is invoked:
 
 For each selected standard (in order of relevance):
 
-1. Read the file at `D:/claudetools/.claude/standards/<slug>.md`.
+1. Read the file at `.claude/standards/<slug>.md`.
 2. Display a header:
    ```
    === STANDARD: <slug> ===
@@ -87,8 +87,8 @@ Reads the recent conversation, infers the task type, selects 2–5 most relevant
 
 ## Standards index location
 
-`D:/claudetools/.claude/standards/index.yml`
+`.claude/standards/index.yml`
 
 ## Standards files location
 
-`D:/claudetools/.claude/standards/<folder>/<name>.md`
+`.claude/standards/<folder>/<name>.md`