Live-checked every claim: Vault mount list, SSH CA role TTLs/algorithm,
the Caddyfile's asymmetric-trust config for Vault (exact match), all
per-host consumer stack counts (12 rocky-docker / 10 automation,
verified against the authoritative docker_secret_templates source, not
just Vault KV path listings which include unrelated Kestra-flow
secrets), the cert-rebuild script's 19-day-incident story, and the
lifecycle diagram - all still accurate. Bumping verified date/SHAs only.