docs(#56): 更正模型 key 库名 heicode-kv → heicode-vault（HM 实测口径）

agent_swarm#56 评论:模型 key 的真实 Key Vault 库名是 `heicode-vault`
(`https://heicode-vault.vault.azure.net`),早期契约文档误写为 `heicode-kv`;
且生产 `SECRET_RESOLVER` 须指向 `heicode-vault`。

- runtime-contract.md §3.3.1 A.3:库名更正 + 标注 SECRET_RESOLVER 指向 heicode-vault
  + 明确 Swarm 需提供 Pod 身份的 clientId+objectId 给 HM 授权(只读、限 swarm-model-key-*)。
- security-boundary.md:secret_ref 示例 host 同步更正。
- test-key-injection-contract.py:模型 key fixture host 同步更正(resolver 仅取末段名,
  功能不变;测试仍全绿)。

纯文档/fixture 更名,无事件 schema/契约字段改动。
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/test-key-injection-contract.py

@@ -44,7 +44,7 @@ async def stored_events(swarm_id):
     return [json.loads(r) for r in raw]
 
 
-async def new_run(user_id, secret_ref="azkv://heicode-kv/secrets/swarm-model-key-u1"):
+async def new_run(user_id, secret_ref="azkv://heicode-vault/secrets/swarm-model-key-u1"):
     body = {
         "mode": "swarm",
         "orchestration_plan": {"objective": "key-contract test"},
@@ -76,7 +76,7 @@ def test_kv_value_format():
     os.environ.pop("AGENT_LAUNCH_MODEL_KEY", None)
     os.environ.pop("OPENAI_API_KEY", None)
     os.environ["HEICODE_SECRET_swarm-model-key-u1"] = '{"openai_api_key": "sk-RESOLVED"}'
-    body = {"billing_context": {"secret_ref": "azkv://heicode-kv/secrets/swarm-model-key-u1"}}
+    body = {"billing_context": {"secret_ref": "azkv://heicode-vault/secrets/swarm-model-key-u1"}}
     check("resolve_model_key resolves the azkv JSON secret to the bare sk-",
           agent_launcher.resolve_model_key(body) == "sk-RESOLVED")
     os.environ.pop("HEICODE_SECRET_swarm-model-key-u1", None)