feat: kh wallet add/info/fund/link wrappers around @keeperhub/wallet

[eskp]

Summary

Adds 4 new `kh wallet` subcommands as thin Cobra wrappers around `npx @keeperhub/wallet `:

• `kh wallet add` — provision a new agentic wallet sub-org
• `kh wallet info` — print stored wallet config (subOrgId + walletAddress; never the HMAC secret)
• `kh wallet fund` — print Coinbase Onramp URL for Base + Tempo address for external transfer
• `kh wallet link` — associate the anon wallet with a KeeperHub user account

Covers DIST-04 of v1.8 Agentic Wallet milestone. Ships alongside the `@keeperhub/wallet` npm package at https://github.com/KeeperHub/keeperhub-wallet.

Design

• Thin wrappers, no business logic — each subcommand invokes `exec.Command("npx", "@keeperhub/wallet", , args...)` with argv slice (no shell, no injection risk). stdin/stdout/stderr forwarded; exit code propagated.
• Env passthrough — forwards `os.Environ()` and injects `KEEPERHUB_API_URL` derived from `--host` flag or `~/.config/kh/hosts.yml` via existing `cmdutil.ResolveHost()`.
• Existing `kh wallet balance` + `kh wallet tokens` preserved — those hit the creator-wallet REST API (different product from the agentic wallet). Help text clarifies the distinction.
• npx dependency check — if `npx` is missing from `$PATH`, prints actionable error and exits 127 (no panic).

Files

• `cmd/wallet/agentic_wrapper.go` — `runNpxWallet` helper + shared subcommand factory
• `cmd/wallet/add.go`, `info.go`, `fund.go`, `link.go` — one file per subcommand
• `cmd/wallet/wallet.go` — wire the 4 new subcommands via `cmd.AddCommand(NewAddCmd(f))`
• `cmd/wallet/agentic_wrapper_test.go` — 5 unit tests (help output, dispatch, argv construction, subcommand registration)

Test plan

• `go build ./...` exits 0
• `go vet ./...` exits 0
• `go test ./cmd/wallet/...` passes (14 tests: 9 preserved + 5 new)
• Compiled `kh wallet --help` lists all 6 subcommands (balance, tokens, add, info, fund, link)
• `kh wallet add --help` prints the agentic-wallet long description referencing `npx @keeperhub/wallet add`
• Acceptance: no `exec.Command("sh"` or shell interpolation anywhere in the new files
• End-to-end smoke after `@keeperhub/wallet` publishes to npm: run `kh wallet add` against staging → expect a real wallet provisioned