Out-of-band Secret -> Infisical homelab/prod /vaultwarden. Parallel-name target vaultwarden-secret-infisical (Owner), passthrough. Old vaultwarden-secret stays live until decommission. Applied via kubectl (not ArgoCD-managed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>