Remove internal notification caller tokens

infra/local/scripts/test.sh

@@ -74,3 +74,22 @@ printf '{"data":{"metadata":{"version":43},"data":{"api_key":"preserved-fixture-
 if (normalize_email_secret) >/dev/null 2>&1; then fail 'Unknown secret field was silently dropped'; fi
 if grep -q EMAIL_CONFIG infra/local/vault/notifications.hcl infra/local/scripts/start-service.sh; then fail 'Email configuration is still rendered from Vault'; fi
 echo 'PASS: email migration preserves API key, removes configuration fields and rejects unknown fields'
+# Caller retirement is repeatable and must not remove NATS authentication.
+secret_moves() { :; }
+printf '{"caller":true,"services/notifications/callers/bff":true,"infrastructure/nats/auth":true}' > "$WORK/retirement"
+vault() {
+ path=${1#kv/metadata/}
+ case "${2:-GET}" in
+  GET) jq -c --arg path "$path" '.[$path] // null' "$WORK/retirement";;
+  DELETE)
+   case "$path" in caller|services/notifications/callers/bff) ;; *) fail 'Unexpected secret retirement';; esac
+   jq --arg path "$path" 'del(.[$path])' "$WORK/retirement" > "$WORK/retirement-next"
+   mv "$WORK/retirement-next" "$WORK/retirement"
+   ;;
+  *) fail 'Unexpected retirement method';;
+ esac
+}
+retire_secrets
+retire_secrets
+jq -e '.=={"infrastructure/nats/auth":true}' "$WORK/retirement" >/dev/null
+echo 'PASS: obsolete caller secrets retired idempotently; NATS authentication preserved'