vault.yml was in .gitignore so CI jobs had no vault variables.
The file is AES-256 encrypted — safe to commit to a private repo.
The password stays in ~/.vault-password-file (still gitignored).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>