docs: the repo map gains the crate this branch adds

/knowledge/doc-standards.md lists "file added -> CLAUDE.md ## Repo map" under
always-update, and "CLAUDE.md after a file rename" under most-commonly-missed.
This branch added a workspace member and I missed it; a scheduled nudge to
re-read the hive rules is what caught it, not a gate.

The entry leads with the BAO_ vs VAULT_ env mismatch because that is the part
a reader cannot derive from the crate name: vaultrs' own defaults look for
VAULT_ADDR / VAULT_CLIENT_CERT / VAULT_CLIENT_KEY, no unit in this tree sets
those, and falling through to them produces a client with no identity whose
only symptom is a TLS handshake failure.

Measured while doing it: 6 of 28 workspace members were absent from the map.
Five predate this branch (hive-jobq-metrics, swarm-authelia-bridge,
swarm-authelia-bridge-sock, swarm-nats-auth, swarm-queue-client) and are
deliberately left alone here rather than widening this PR.

Refs #3726

CLAUDE.md

@@ -147,6 +147,14 @@ hand-maintained per-file tree drifts out of sync with the code.
   unix socket the gateway's nginx proxies to — ⚠️ **the socket's
   directory is its access control**; the constraint that governs it is in
   the crate's README, and a unit test pins the path.
+- **`swarm-secret-client/`** — client for the swarm's secret store, over
+  `vaultrs`. Owns the *agreements* both ends of the store must share rather
+  than the HTTP: the path a credential lives at, the field its bytes are in,
+  and the translation from this deployment's environment into a logged-in
+  client. ⚠️ Reads the **`BAO_`** env spellings explicitly — `vaultrs`'s own
+  defaults look for `VAULT_ADDR`/`VAULT_CLIENT_CERT`/`VAULT_CLIENT_KEY`, which
+  no unit in this tree sets, so falling through to them yields a client with
+  **no identity** and a TLS handshake failure that names no cause.
 - **`swarmctl/`** — swarm-level operator CLI, installed by the
   swarm-controller module on the host that runs the daemon. Runs as
   **root and acts directly** — no socket, no HTTP route, no priv helper;