Run the production Vault as three raft nodes on exch and infra-gamma

Two nodes on exch and one on infra-gamma, plain Compose per server, ports
on the private addresses only. Nodes unseal through the transit seal on the
platform Vault; the transit token reaches only the server process.

make prod-images resolves the latest stable Vault release once and pins its
digest in ignored .local/prod/images.env, so every node runs the same build.

infra/prod/README.md records the layout, the first rollout, node
replacement and recovery when the platform Vault is lost (#74).

infra/prod/vault/start.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Hands the transit seal token to the Vault server process only: it is read
+# from the secret file here, so it is not part of the container environment.
+set -eu
+VAULT_TOKEN=$(cat /run/secrets/transit-token)
+[ -n "$VAULT_TOKEN" ] || { echo 'Empty transit seal token' >&2; exit 1; }
+export VAULT_TOKEN
+exec docker-entrypoint.sh vault server -config=/vault/config/vault.hcl