The 495MB vault binary is in .gitignore so it doesn't ship to Forgejo, breaking 'COPY vault /usr/local/bin/vault'. Switch to the standard download-zip-then-unzip pattern used for terraform and sops in this same Dockerfile.