Remove internal notification caller tokens

infra/local/scripts/secrets.sh

@@ -1,8 +1,7 @@
-# Canonical paths follow ownership. Shared callers live under the receiving service.
+# Canonical paths follow ownership.
 secret_moves() {
  cat <<'PATHS'
 bff services/bff/jwt
-caller services/notifications/callers/bff
 email services/notifications/email/resend
 nats infrastructure/nats/auth
 bootstrap/mongo infrastructure/mongo/bootstrap
@@ -47,7 +46,7 @@ retire_secrets() (
   archive_secret "$old"
   printf '{}' | vault "kv/metadata/$old" DELETE >/dev/null
  done < "$WORK/moves"
- for old in tls frontend-tls notifications-tls; do
+ for old in caller services/notifications/callers/bff tls frontend-tls notifications-tls; do
   archive_secret "$old"
   if [ "$(vault "kv/metadata/$old" GET yes)" != null ]; then printf '{}' | vault "kv/metadata/$old" DELETE >/dev/null; fi
  done