fix(secrets): use shared metadata guard for Key Vault

[cristim]

Summary

Use the existing shared resolved-address metadata guard for Azure Key Vault instead of the resolver's literal-host map. This closes the IPv4-mapped metadata-address bypass without changing dependencies or banning private endpoints.

Keep the production transport in the local TLS fixture, and cover constructor-to-GetSecret rejection plus the real SDK request path, authorization header, and returned secret.

Refs LeanerCloud/cloud-commitments-go#25

Exact-head verification

Head: b97a8d0068878c4ab581d6125e1326588a1c095e.

• Independent adversarial gpt-6-astra review: no actionable findings; reviewer independently executed all native checks below.
• Actual-parent production overlay: literal metadata control passes; mapped-address regression fails at the intended assertion.
• Bare-transport mutation: both metadata cases fail at the intended assertions. Kernel network denial prevents the negative controls from reaching metadata services.
• Fixed constructor: both metadata cases pass. Real SDK GetSecret through the local TLS fixture passes.
• Native macOS Go 1.26.6: secrets-package race suite has 245 passing events and four existing credential-dependent GCP skips; repository build passes; focused configured lint reports zero issues.
• Normal commit hooks passed before rebase; normal-config hooks for both changed files passed again on this exact rebased commit, including tidy, vet, gosec and Trivy. No checks bypassed.

Limits and merge hold

Positive SDK evidence uses synthetic credentials and a local TLS endpoint, not live Azure authentication or a deployed Private Link endpoint. Existing cloud-URL error-path tests run under kernel network denial. The local git-secrets configuration has no patterns, so its Passed status does not establish AWS credential-pattern coverage.

Exact-head CI and project-required real-scenario acceptance remain merge gates. No merge approval is claimed. This does not resolve the broader public-only policy work in LeanerCloud/cloud-commitments-go#20 or #152; #25 remains open for its remaining scope. Labels mirror #25's existing historical classification.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 2 billable files and costs up to $0.50.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 13 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 81 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 92ab4ffb-ed80-4ac8-b88b-83823e1bfd43

📥 Commits

Reviewing files that changed from the base of the PR and between b4c982a and b97a8d0.

📒 Files selected for processing (2)

• internal/secrets/azure_resolver.go
• internal/secrets/azure_resolver_httptest_test.go

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Exact-head CI completed successfully at b97a8d0: Build & Test run 37240109834 and pre-commit run 37240109843. The independent Astra verdict and native evidence in the PR body cover this same head. CodeRabbit supplied only a review-limit notice, not a substantive review; no billing or review bypass was used. This PR remains open under the recorded real-scenario acceptance hold; green CI is not live Azure/Private Link proof.