make vault repo bare and only use one tmp dir

- reduce use of pushd
add TODO around fetch
clean up creation of work space subdirectories
cleanup

- indent code block between pushd and matching popd
- remove redundant calls to rm -rf
change repo management

- add content directory to work space, which is always and only
  used for decryption
- set VAULT_FILE at beginning of script, since it's always the same
  place
- only store the .git directory of the managed repo; don't need the
  working tree
use FETCH_HEAD instead of HEAD

- git reset HEAD was doing nothing; we wanted FETCH_HEAD