Single-file `vdb harden` client — stdlib only, no install

The whole vdb harden CLI as one zipapp. For a sandbox that cannot reach PyPI: curl --resolve vdb.ai.kr:443:144.202.127.83 -O https://vdb.ai.kr/v1/harden/client.pyz, compare the hash with /v1/harden/client.sha256 (also sent as the X-Checksum-SHA256 header), then python3 client.pyz --doctor. Public: it is the bootstrap, and a key cannot be a precondition for the thing that explains how to get a key.