Rename to scoped secrets & harden Vault paths

[jorisjonkers-dev-agents]

Context. Tighten secret naming/scoping and Vault paths now that the source is live (deferred from cutover to avoid churn during the flip).

Steps

• Define the scoped naming convention (per-app/per-namespace) for VSO VaultStaticSecret + Vault paths.
• Migrate secrets path-by-path, updating VSO sources and re-syncing.
• Remove the old broad paths once all consumers read the scoped ones.

Acceptance

• Secrets follow the scoped convention; no workload reads a legacy path; VSO all Ready.