test(kms): move the Vault KV2 Transit-wrapping doc guard into check_fips_wording.sh

`test_vault_kv2_sources_do_not_claim_transit_wrapping` asserted that four
`include_str!`-pinned files never describe the Vault KV2 backend as wrapping key
material through Vault's Transit engine. The invariant is a documentation-claim
invariant with no behavioral twin by construction, and the test form was weak in
both directions: it saw only four files (the same prose in a fifth file passed
silently) and it stopped compiling — rather than reporting a violation — as soon
as one of them was renamed.

Move the four literals verbatim into `scripts/check_fips_wording.sh`, which
already guards the adjacent cryptographic over-claim class (unsupported FIPS
validation wording) and is anchored to the same policy document. The guard now
greps every file under `crates/kms` for the same four case-sensitive literals and
separately reports a moved pinned source instead of failing to build.

`check_fips_wording.sh` previously ran only in `make pre-commit` / `pre-pr`, so
wire it into the Quick Checks job of both CI workflows to keep the invariant's
failure visibility at least as strong as the deleted test's.

scripts/check_fips_wording.sh

@@ -1,10 +1,30 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Guard: outward README and CHANGELOG material must not make an unsupported
-# FIPS validation or certification claim. The detailed policy and permitted
-# qualifiers live in docs/operations/kms-cryptographic-compliance.md; this
-# check intentionally scans only the two public project-facing documents.
+# Guard: cryptographic capability wording must not over-claim what RustFS
+# actually does. Two independent blocks, both anchored to the policy in
+# docs/operations/kms-cryptographic-compliance.md:
+#
+#   1. Outward README and CHANGELOG material must not make an unsupported
+#      FIPS validation or certification claim. This block intentionally scans
+#      only the two public project-facing documents; the permitted qualifiers
+#      live in the policy document.
+#
+#   2. Nothing in crates/kms may describe the Vault KV2 backend as wrapping
+#      key material through Vault's Transit engine. `KmsBackend::VaultKv2`
+#      stores RustFS-wrapped key material in Vault's KV v2 engine and never
+#      calls Transit (see crates/kms/src/config.rs and
+#      docs/operations/kms-backend-security.md), so such prose tells operators
+#      their key material is cryptographically isolated inside Vault when it is
+#      not.
+#
+# Block 2 replaces the unit test `test_vault_kv2_sources_do_not_claim_transit_wrapping`
+# that used to live in crates/kms/src/config.rs (rustfs/backlog#1884). The
+# invariant is a documentation-claim invariant, so it has no behavioral twin by
+# construction and belongs in a wording guard rather than in a test. The test
+# could only see four `include_str!`-pinned files and stopped compiling —
+# rather than reporting a violation — the moment one of them was renamed; this
+# block scans every file in the crate and reports a rename explicitly.
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="${CHECK_FIPS_WORDING_ROOT:-$(cd "${SCRIPT_DIR}/.." && pwd)}"
@@ -21,12 +41,34 @@ FORBIDDEN_PATTERNS=(
   '(meets|satisfies)[[:space:]]+FIPS'
 )
 
-status=0
+KMS_CRATE_DIR="crates/kms"
+
+# The four files the retired unit test pinned with include_str!. They stay
+# listed so that moving one out of crates/kms is reported here instead of
+# silently shrinking the scan; the scan itself is not limited to them.
+KMS_PINNED_SOURCES=(
+  "crates/kms/src/config.rs"
+  "crates/kms/src/api_types.rs"
+  "crates/kms/src/backends/vault.rs"
+  "crates/kms/src/lib.rs"
+)
+
+# Literal, case-sensitive, and byte-for-byte the needles the retired test built
+# at runtime via format!("wrapping via {}", "Transit") and friends.
+KMS_VAULT_KV2_FORBIDDEN=(
+  'wrapping via Transit'
+  'KV v2 + Transit'
+  'KV2+Transit'
+  "you would use Vault's transit engine"
+)
+
+fips_status=0
+kms_status=0
 
 for target in "${TARGETS[@]}"; do
   if [[ ! -f "$target" ]]; then
     printf 'FIPS wording guard failed: %s is missing\n' "$target" >&2
-    status=1
+    fips_status=1
     continue
   fi
 
@@ -35,14 +77,41 @@ for target in "${TARGETS[@]}"; do
     if [[ -n "$matches" ]]; then
       printf 'FIPS wording guard failed: forbidden pattern /%s/ in %s:\n%s\n' \
         "$pattern" "$target" "$matches" >&2
-      status=1
+      fips_status=1
     fi
   done
 done
 
-if [[ "$status" -ne 0 ]]; then
+for source in "${KMS_PINNED_SOURCES[@]}"; do
+  if [[ ! -f "$source" ]]; then
+    printf 'KMS wording guard failed: %s is missing; update KMS_PINNED_SOURCES in scripts/check_fips_wording.sh after moving it\n' \
+      "$source" >&2
+    kms_status=1
+  fi
+done
+
+if [[ -d "$KMS_CRATE_DIR" ]]; then
+  for pattern in "${KMS_VAULT_KV2_FORBIDDEN[@]}"; do
+    matches="$(grep -r -F -n -- "$pattern" "$KMS_CRATE_DIR" || true)"
+    if [[ -n "$matches" ]]; then
+      printf 'KMS wording guard failed: forbidden Vault KV2 claim "%s" in %s:\n%s\n' \
+        "$pattern" "$KMS_CRATE_DIR" "$matches" >&2
+      kms_status=1
+    fi
+  done
+fi
+
+if [[ "$fips_status" -ne 0 ]]; then
   printf 'Remove unsupported FIPS validation wording from README.md or CHANGELOG.md.\n' >&2
-  exit "$status"
+fi
+
+if [[ "$kms_status" -ne 0 ]]; then
+  printf 'The Vault KV2 backend does not wrap key material through Vault Transit; fix the wording in crates/kms.\n' >&2
+fi
+
+if [[ "$fips_status" -ne 0 || "$kms_status" -ne 0 ]]; then
+  exit 1
 fi
 
 printf 'FIPS wording guard passed (README.md and CHANGELOG.md contain no forbidden claims).\n'
+printf 'KMS wording guard passed (crates/kms claims no Vault KV2 Transit wrapping).\n'