feat: import-key/export-key + HULAK_MASTER_KEY fallback

[xaaha]

Summary

Closes #131

• ResolveIdentity() — fallback chain: HULAK_MASTER_KEY env var → identity.txt file
• All decrypt call sites switched from LoadIdentity() → ResolveIdentity()
• Friendly error wrapping when HULAK_MASTER_KEY doesn't match recipients
• hulak env export-key with --out/-o flag
• hulak env import-key with --stdin, --force, atomic tmp+rename
• Extracted utils.AtomicWriteFile (used by both ImportKey and WriteStore)
• Removed notImplemented stub — all env commands wired

Test plan

• go test ./... passes
• go vet ./... clean
• E2E: hulak env export-key prints key with stderr warning
• E2E: hulak env export-key --out /tmp/test.txt writes 0600 file
• E2E: hulak env import-key /tmp/test.txt --force imports successfully
• E2E: echo "$KEY" | hulak env import-key --stdin works
• E2E: HULAK_MASTER_KEY=<valid-key> hulak env get KEY --env prod decrypts
• E2E: HULAK_MASTER_KEY=<wrong-key> hulak env get KEY shows friendly error
• E2E: HULAK_MASTER_KEY=age1... hulak env get KEY says "looks like a public key"