Gullet: validate tab_clip's vault override against Obsidian's registry

[mlsimon734]

tab_clip takes an optional vault (#14) that overrides the destination for one
call. Nothing validates that the vault exists, so a name Obsidian does not
recognise fails inside Obsidian, where neither end of the bridge can observe
it — and the tool still reports success. The parameter's description currently
compensates by telling the agent never to guess at a name, which is a weaker
guarantee than an error would be.

The extension cannot check this; Gullet can

The extension has no filesystem access, and the handoff is a URL given to the OS,
so from that side the failure is genuinely invisible. That is why the check was
written off in #14.

But Gullet is a Bun process, and it is on the same host as the browser — loopback
binding guarantees it — and therefore the same host as whatever handles
obsidian://. It is also where the tool schema lives and where the call arrives.
So it can reject an unknown vault name before forwarding, and name the valid
ones in the error, which beats an agent guessing.

Obsidian keeps a vault registry:

• macOS: ~/Library/Application Support/obsidian/obsidian.json
• Linux: ~/.config/obsidian/obsidian.json
• Windows: %APPDATA%\obsidian\obsidian.json

It maps vault ids to { path, ts, open }, and the name vault= expects is the
path's basename. Confirmed working locally — reading it listed four vaults by the
exact names Obsidian's switcher shows.

It has to stay a soft check

An unreadable, absent, or unparseable registry must degrade to "cannot check,
forward it anyway", never to "that vault does not exist". Three reasons, each
of which alone is enough:

• obsidian.json is an undocumented internal file. Obsidian owns its shape and
  owes us no stability.
• It lists only vaults Obsidian has opened. A vault that exists on disk but has
  never been opened is absent from it, and refusing that clip would be wrong.
• Flatpak and Snap installs relocate it, and the Mac App Store sandbox may too.

So: read it if it is there, reject with the known names if the file parses and
the name is absent, and pass through silently otherwise. The error should say it
is listing known vaults, not all vaults.

Notes

• Gullet has zero dependencies and should keep them; this is Bun.file + JSON.parse.
• Worth caching per process, but invalidate cheaply — a vault created mid-session
  should not be permanently unknown.
• The same registry could let tab_clip report the vault's filesystem path
  alongside the vault-relative file it already returns, which would make a
  filed note directly openable. Optional, and only worth it if it stays soft in
  the same way.