Rename to scoped secrets & harden Vault paths

[jorisjonkers-dev-agents]

Context. Tighten secret naming/scoping and Vault paths now that the source is live (deferred from cutover to avoid churn during the flip).

Steps

• Define the scoped naming convention (per-app/per-namespace) for VSO VaultStaticSecret + Vault paths.
• Migrate secrets path-by-path, updating VSO sources and re-syncing.
• Remove the old broad paths once all consumers read the scoped ones.

Acceptance

• Secrets follow the scoped convention; no workload reads a legacy path; VSO all Ready.

[ExtraToast]

Partly done — status as of 2026-08-27

Measured against the acceptance criteria rather than closed on age.

25 VaultStaticSecrets exist. 9 are scoped; 16 still read the broad platform/ path:

path prefix	count	scoped?
platform/	16	no — the legacy broad path
agents/	5	yes
knowledge-system/	3	yes
auth-api/	1	yes

So step 1 (define the convention) is evidently done — the scoped names follow a consistent per-app/per-namespace shape. Steps 2 and 3 are two-thirds outstanding, and the acceptance criterion "no workload reads a legacy path" is not met.

VSO is not all Ready either. One is failing:

agents-system/github-api-token   SecretSynced=False
  err=empty response from Vault, path="secret/data/agents/github-api-token"

That one is a live defect rather than a migration gap — the Vault path is empty and the Kubernetes Secret does not exist, while agents-api references it as optional: true and therefore runs without it, silently. Filed separately as JorisJonkers-dev/workspace#61, since it needs fixing regardless of this migration.

Leaving open, with the remaining work now quantified: 16 paths to migrate.