Keep email runtime configuration out of Vault

infra/local/scripts/test.sh

@@ -59,3 +59,18 @@ printf '{"api_key":"different-fixture"}' > "$WORK/destination"
 if (migrate_secrets) >/dev/null 2>&1; then fail 'Migration overwrote conflicting destination'; fi
 jq -e '.api_key=="different-fixture"' "$WORK/destination" >/dev/null
 echo 'PASS: secret migration is repeatable and refuses conflicting destination values'
+# Removing non-secret fields retains the key and checks the current KV version.
+vault() {
+ if [ "${2:-GET}" = GET ]; then cat "$WORK/email-fixture"; else
+  jq -e '.options.cas==42 and .data=={api_key:"preserved-fixture-key"}' > /dev/null || return 1
+  printf '{"data":{"metadata":{"version":43},"data":{"api_key":"preserved-fixture-key"}}}' > "$WORK/email-fixture"
+ fi
+}
+printf '{"data":{"metadata":{"version":42},"data":{"api_key":"preserved-fixture-key","driver":"resend","sender_address":"sender@example.test","sender_name":"Fixture"}}}' > "$WORK/email-fixture"
+normalize_email_secret
+normalize_email_secret
+jq -e '.data.data=={api_key:"preserved-fixture-key"}' "$WORK/email-fixture" >/dev/null
+printf '{"data":{"metadata":{"version":43},"data":{"api_key":"preserved-fixture-key","unexpected":"must-not-drop"}}}' > "$WORK/email-fixture"
+if (normalize_email_secret) >/dev/null 2>&1; then fail 'Unknown secret field was silently dropped'; fi
+if grep -q EMAIL_CONFIG infra/local/vault/notifications.hcl infra/local/scripts/start-service.sh; then fail 'Email configuration is still rendered from Vault'; fi
+echo 'PASS: email migration preserves API key, removes configuration fields and rejects unknown fields'