Old root token and unseal keys were dead (lost access to the previous Vault store). Wiped the S3 backend and vault-0, re-initialized fresh, rotated these to match the new live unseal keys so ArgoCD's next sync doesn't clobber them back to the dead ones.