Two Key Vault SDKs, One Password in Plain Sight
One class bridging the legacy ADAL KeyVaultClient and the modern SecretClient, three coexisting secret postures - managed identity, a service-principal password in config, a committed key file - and a migration frozen mid-flight.