fix: require Vault audit signing in production

packages/casan-harness/scripts/bash/sign-audit-head.sh

@@ -103,6 +103,10 @@ PY
   fi
 else
   # Fallback — local key (dev environment without Vault)
+  if [[ "${CASAN_PROFILE:-}" == "prod" ]]; then
+    echo "SIGN_AUDIT_HEAD_FAIL reason=vault_kms_required_in_prod" >&2
+    exit 1
+  fi
   AUDIT_PRIV="$CASAN_GOVERNANCE_ROOT/audit-private.pem"
   if [[ ! -f "$AUDIT_PRIV" ]]; then
     echo "SIGN_AUDIT_HEAD_SKIP no private key and VAULT_ADDR not set — verify will show anchor=unsigned" >&2