* fix(kms): handle concurrent Vault KV2 baseline races * test(kms): keep concurrent rotation regression fail-closed