[ExtraToast]

Closes #2516

What changes

• scripts/unseal-vault.sh unseals vault-v2-0 in data-system:
  1. It uses the blueshell context, or KUBE_CONTEXT=<name>, never kubectl's current context, and asks the operator to type yes after showing the API server.
  2. It port-forwards to pod/vault-v2-0 on a free local port. The pod, not svc/vault-v2, because a sealed Vault is not ready.
  3. It shows the share count and runs vault operator unseal on a hidden prompt until Vault opens. No share reaches a command line or disk.
  4. It waits for the pod to become ready. The port-forward closes on any exit.
• platform/docs/vault-bootstrap.md points to the script after a restart and names vault-v2-0 in place of the old vault-0.

The context check and port-forward follow migrate-vault.sh and restore.sh.

Checked

• bash -n passes.
• The port-forward and status part ran against blueshell while Vault was sealed after a reboot: it read sealed: true, 0 of 3 shares.
• The share prompts have not run yet; they need the shares.

[github-actions]

Changes

Bucket	Files	Added	Removed
platform	1	█ 7	░ 6
build & config	1	██████████ 63
total	2	+70	−6

No production or test lines added.

Coverage

	Statements	Branches	Functions	Lines
api	76.25%	70.75%	65.26%	78.54%
main 3bcbbed	—	—	—	—
frontend	92.81%	88.10%	90.34%	93.43%
main 3bcbbed	92.81%	88.10%	90.34%	93.43%
Δ	0.00	0.00	0.00	0.00
imaging	100.00%	100.00%	100.00%	100.00%
main 3bcbbed	—	—	—	—

Patch coverage: this pull request changes no line that coverage measures.