#268 Require target-first lockbox commands

[bsutton]

Fixes #268

Summary

• require lockbox [LOCKBOX] <command> for every lockbox-scoped command
• reject command-first lockbox paths with actionable guidance
• preserve session-default operation when the target is omitted
• update help, README documentation, completion fixtures, and CLI tests

Verification

• cargo test --locked -p revault_cli (65 CLI integration tests passed; the completion fixture was then corrected and its suite rerun)
• cargo test --locked -p revault_cli --test completion
• cargo test --locked -p revault_cli --test migration_cli archive_migration_commands_and_options_execute_end_to_end -- --exact --nocapture
• cargo clippy --locked -p revault_cli --all-targets -- -D warnings
• git diff --check