fix: split HashiCorp Vault namespace/path_prefix and validate store status

[fedemaleh]

Problem

On a HashiCorp Vault Enterprise namespace, parameter:store returned success but parameter:retrieve then 404'd for the same external_id.

Two chained defects:

1. Silent write failure in store. store only checked curl's exit code. curl -s exits 0 even on HTTP 4xx/5xx, so a failed KV write was reported as success (the returned external_id came back with no #version suffix — a tell that .data.version was absent and the POST never produced a KV v2 write body).
2. No place for the KV mount on Enterprise namespaces. The single setup.namespace field + "strip trailing /data" heuristic meant admin/ns/data → namespace admin/ns, KV path data/…. But a real KV v2 write needs <namespace>/<mount>/data/<subpath> — the mount name (e.g. secret) had no place, so the write landed on a non-existent path. No single value made both login and read/write work.

Fix

• store now validates the HTTP status (-w "%{http_code}") and fails loudly with the Vault response body on non-2xx.
• Split the config into two independent axes:
  • setup.namespace (env VAULT_NAMESPACE) — Vault Enterprise namespace, applied as a URL prefix on login and every store/retrieve/delete request. Empty = root namespace (backward compatible with Vault OSS).
  • setup.path_prefix (env VAULT_PATH_PREFIX, default secret/data/nullplatform) — the KV v2 <mount>/data/<subpath> prefix, embedded in the external_id.
• Removed the trailing-/data heuristic. store/retrieve/delete compose the namespace prefix consistently; the Vault namespace is no longer embedded in the external_id (changing it is a migration, documented).
• setup validates namespace/path_prefix against [A-Za-z0-9._/-] and rejects .. before interpolating into URLs (defense-in-depth).
• Updated the config schema template, Terraform install spec (variables.tf, locals.tf, terraform.tfvars.example), README, architecture doc, and CHANGELOG.

Migration note

setup.namespace no longer holds the KV path. Configure the two fields separately, e.g. for an HCP namespace admin/eks-null-alfa-136 with the default KV mount:

• namespace = admin/eks-null-alfa-136
• path_prefix = secret/data

Test plan

• bats suite: 190/190 passing, including new regression tests for the silent-write bug (non-2xx → failure), the namespace URL-prefix on store/retrieve/delete, and namespace/path_prefix validation.
• tofu validate on the install spec: OK.