Drift item #2: replace all .read().unwrap()/.write().unwrap() calls in VaultServiceHandle with .unwrap_or_else(|e| e.into_inner()) to recover from poisoned locks instead of bricking the vault. Added test_poisoned_lock_recovery that poisons the lock via a panicking thread and verifies the vault remains usable. Refs: docs/architecture/crates/vault/README.md drift #2 Implements: ADR-025 # Conflicts: # crates/alknet-vault/src/service.rs