docs(vault): record the move of secret/teams/platform to platform/legacy

[mashkovd]

Docs only. This records the owner-approved move of the legacy secret/teams/platform/ folder to secret/platform/legacy/teams-platform/ in docs/runbooks/vault-human-auth.md.

Why. Since #1655, tenants can list the folder names directly under secret/teams/. A legacy platform folder sat there next to the tenant folders, so every tenant could see its name.

What moved, on 2026-10-04 at 21:31Z, by an admin token:

• teams/platform/mctl-agent/database → platform/legacy/teams-platform/mctl-agent/database (latest version)
• teams/platform/mctl-agent/tokens → platform/legacy/teams-platform/mctl-agent/tokens (latest version)

Checks:

• Before the move: no references. Checked with gh search code across the org's default branches, in the live cluster (ExternalSecrets and their stores, workloads, ConfigMaps, Argo workflow templates, pods), and in every Vault policy and Kubernetes auth role.
• The copies match. A SHA-256 of the data was compared on both sides, and no value was printed.
• The old versions are gone. The old paths were removed with vault kv metadata delete, and every old version now returns 404.
• After the move:
  • teams/ lists only tenants.
  • An admin can read the copies.
  • A human-tenant-erpact token gets 403 on them.

The runbook also states that only tenant folders belong directly under teams/, and points to #1670 for per-tenant mounts.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D1kGUJMWeA8hyhQuxKuHd2

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.8-flash-medium · commit a934374.

No significant issues found.

[claude]

Claude finished @mashkovd's task in 28s —— View job

---

Review complete ✅

• Gather context (PR body, diff, CLAUDE.md conventions)
• Review diff for correctness/security issues
• Submit verdict

Verdict: Approved. This is a docs-only change — two new sections added to docs/runbooks/vault-human-auth.md recording a completed Vault secret migration (secret/teams/platform/ → secret/platform/legacy/teams-platform/) and a clarifying note that only tenant folders belong directly under teams/. No manifests, Helm values, RBAC, or workflow files are touched, and the diff contains only paths/dates/process description — no secret values. Falls under the "trivial diff" criteria (docs/comments), so approved per the automated review policy.

[claude]

Docs-only change recording a completed Vault secret migration; no code, manifests, or secret values touched.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.8-flash-medium · commit 8016d2f.

No significant issues found.

[claude]

Claude finished @mashkovd's task in 27s —— View job

---

Review complete ✅

• Gather context (PR description, diff, CLAUDE.md)
• Review diff for correctness/security/operational safety
• Post verdict

Verdict: Approved. This is a docs-only change (docs/runbooks/vault-human-auth.md, +45/-0) recording an already-completed Vault secret move (secret/teams/platform/ → secret/platform/legacy/teams-platform/). No manifests, Helm values, RBAC, or ArgoCD specs are touched, and no secret values appear in the diff — only paths, a SHA-256-comparison description, and audit-log query results. Content is internally consistent: the table of moved paths matches the prose, and the stated access checks (tenant 403, admin 200, 404 on old paths) align with the stated goal.

Approved per gh api .../reviews --method POST -f event="APPROVE" bound to commit 8016d2f1.

[claude]

Docs-only change (runbook update recording an already-completed Vault secret move); no code/config/manifest changes, no secrets exposed in the diff.