[Sukitly]

Summary

• bundle the checksum-pinned official age-keygen 1.3.1 executable as a private sidecar alongside SOPS
• add gitveil identity generate and gitveil identity recipients for complete first-use setup without a system age installation
• publish generated identities atomically without replacement, enforce owner-only permissions, reject unsafe staged files, and redact child-process output
• extend native archives, transactional local installation, license notices, quickstart coverage, and public documentation for the complete three-executable distribution
• share timeout, capture, and install-prefix sidecar infrastructure between SOPS and age-keygen

Security properties

• installation never generates an identity
• identity generation never replaces an existing leaf
• private identity bytes do not enter argv, stdout, stderr, logs, or tracked fixtures
• staging directories use mode 0700 and identity files use mode 0600
• staged symlinks, hard links, non-regular files, concurrent publication races, missing sidecars, wrong versions, and child failures fail closed
• runtime discovery never falls back to age-keygen on PATH
• release packaging verifies the official age archive checksum and the extracted age-keygen bytes

Validation

• cargo test --test integration_identity
• cargo test --test integration_quickstart
• cargo test --test cli_contract
• cargo test --test package_contract
• cargo clippy --all-targets --all-features --locked -- -D warnings
• cargo fmt --all -- --check
• python3 scripts/check-docs.py
• python3 scripts/check-architecture.py
• Python and shell syntax checks
• English-only, private-reference, diff, and partial-download residue scans

The complete Linux and macOS host gates are delegated to this pull request's required GitHub Actions checks.