fix: require Vault audit signing in production

packages/casan-harness/scripts/bash/sign-audit-head.sh

@@ -103,6 +103,10 @@ PY
   fi
 else
   # Fallback — local key (dev environment without Vault)
+  if [[ "${CASAN_PROFILE:-}" == "prod" ]]; then
+    echo "SIGN_AUDIT_HEAD_FAIL reason=vault_kms_required_in_prod" >&2
+    exit 1
+  fi
   AUDIT_PRIV="$CASAN_GOVERNANCE_ROOT/audit-private.pem"
   if [[ ! -f "$AUDIT_PRIV" ]]; then
     echo "SIGN_AUDIT_HEAD_SKIP no private key and VAULT_ADDR not set — verify will show anchor=unsigned" >&2

packages/casan-harness/tests/phase-sec02-tests.sh

@@ -56,6 +56,12 @@ env CASAN_VERIFY_STRICT=1 CASAN_AUDIT_KEY_DIR="$KD2" bash "$BASH_DIR/governance-
   && pass "unsigned head from enforced run FAILS strict verify (fail-closed)" \
   || fail "unsigned head passed strict verify"
 
+# 4) Production must never silently fall back from Vault Transit to a local key.
+printf '{"timestamp":"2026-07-18T00:00:00Z","action":"test"}\n' > "$WORK/audit.jsonl"
+[[ "$(rc_of env CASAN_PROFILE=prod VAULT_ADDR= VAULT_TOKEN= CASAN_GOVERNANCE_ROOT="$WORK/prod-gov" bash "$BASH_DIR/sign-audit-head.sh" "$WORK/audit.jsonl")" -ne 0 ]] \
+  && pass "prod audit signer refuses local-key fallback when Vault is unavailable" \
+  || fail "prod audit signer accepted a local-key fallback"
+
 echo ""
 echo "===== SEC-02 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
 [[ "$FAIL" -eq 0 ]] || exit 1