pub fn compute_mac(vault: &Vault) -> String
Compute an integrity MAC over the vault’s secrets and schema. Covers: sorted key names, encrypted shared values, recipient pubkeys.