#3805 Repos without defaultVault: the fallback vault for sensitive outputs is not defined, changed between releases, and doctor vaults does not flag it

Problem

A repo created in 2026-05 (before #3259) has no defaultVault in .swamp.yaml and two vaults:

• local-secrets (local_encryption, id 425a227a-…)
• infra (@swamp/1password, id ddea9575-…)

@keeb/proxmox/node auth writes sensitive fields (ticket, csrfToken, username), which swamp stores in a vault and replaces with ${{ vault.get(...) }} references.

• swamp 20261003 (2026-10-04): the fields were stored in local-secrets.
• swamp 20261022.012520.0 / 20261022.161828.0 (2026-10-22): they were stored in infra — for a direct behavior run as well as a workflow step. Nothing in the repo config changed.

infra is not the lowest vault id (#3680 describes the fallback as the first user vault, lowest id), and the vault reference only says "the first vault when none is set". It does match the order of swamp vault list.

Impact

With no config change, Proxmox session tickets started being written into a 1Password vault. On a laptop, op needs desktop-app approval to write, so an unattended auth failed with 1Password authentication failed … authorization timeout, and later reads of the stored reference failed too (the error shown was "Refusing to evaluate expression … arrived as data content", which pointed away from the vault).

Gaps

• The docs do not define which vault "first" means, and the description disagrees with #3680.
• swamp repo upgrade never adds defaultVault to an existing repo, so older repos rely on the undefined fallback.
• swamp doctor vaults passes ("All behaviors with sensitive outputs have a vault configured") with two vaults and no defaultVault.

Proposed solution

1. Define the fallback order in the docs (vault reference + vault resolution order) and keep it stable, or note changes in the release notes.
2. swamp doctor vaults: warn when the repo has more than one vault and no defaultVault, name the vault the fallback would pick, and suggest setting defaultVault.
3. Optionally, have swamp repo upgrade suggest defaultVault when more than one vault exists.

Workaround

Set defaultVault: <vault> in .swamp.yaml. After defaultVault: local-secrets, both behavior run and workflow steps store the fields in local-secrets again (verified on 20261022.161828.0).

Environment

• swamp 20261022.161828.0-sha.3cef43ef (macOS, Apple silicon)
• @keeb/proxmox 2026.07.18.1
• Vault types: local_encryption, @swamp/1password 2026.05.23.2