778ad61017
The vault item is named HINDSIGHT_API_LLM_API_KEY (matching the daemon env var), while the setup wizard uses HINDSIGHT_LLM_API_KEY. Vault-fed scopes carrying only the API-prefixed name resolved empty, so the scopeless path — and the whole fail-closed machinery — never engaged on real deployments. Accept both names. Proven end-to-end: hydrated scope now resolves the 73-char key and the rewrite gate passes. (cherry picked from commit 2ce8c2980188ae8e4a3ed398e14fa8ed89a40644)