Two should-fix findings from automated Codex review:
1. Vault KV v2 policy path — add explicit path for exact top-level
`secret/data/k3s/<app>` entry alongside the wildcard `/*` sub-path
rule. Without the exact path, apps reading the top-level secret get
permission denied from Vault KV v2 even with the wildcard.
2. Go envconfig example — remove unused `os` import from config.go
snippet (os was only referenced in a comment). Move the main() usage
to a separate clearly-labelled main.go block to make both snippets
copy-paste compilable.
Both fixes mirrored to duplicate path:
guides/ <-> packages/mosaic/framework/guides/
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
