fix: init-envrc pre-fills DD_API_KEY/DD_APP_KEY from secret/audit

The init-envrc template now writes active exports fetching from
secret/audit/datadog-api-key and secret/audit/datadog-application-key
(field=value), instead of commented placeholder examples. The follow-up
hint is source-agnostic (no Vault mention) since a user may source
credentials differently in the .envrc.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Yhoorneman

README.md

@@ -66,7 +66,7 @@ rather than the tool executing shell itself):
 
 ```sh
 datadog-slo-overrides init-envrc                 # writes ~/.config/datadog-slo-overrides/.envrc
-# edit it to `export DD_API_KEY=...` / `export DD_APP_KEY=...` (e.g. from Vault), then:
+# it pre-fills DD_API_KEY / DD_APP_KEY exports; review and adjust the source if needed, then:
 direnv allow ~/.config/datadog-slo-overrides
 ```
 

src/datadog_slo_overrides_cli/datadog_slo_overrides_cli.py

@@ -963,9 +963,9 @@ def envrc_template() -> str:
         '# Read only as a fallback: an explicit --api-key/--app-key or an already-set\n'
         '# DD_API_KEY / DD_APP_KEY in your shell always take precedence.\n'
         '\n'
-        '# Example — fetch from Vault (needs a valid token; run `vault login` first):\n'
-        '# export DD_API_KEY="$(vault kv get -field=value secret/datadog/api-key)"\n'
-        '# export DD_APP_KEY="$(vault kv get -field=value secret/datadog/app-key)"\n'
+        '# Fetch from Vault (needs a valid token; run `vault login` first):\n'
+        'export DD_API_KEY="$(vault kv get -field=value secret/audit/datadog-api-key)"\n'
+        'export DD_APP_KEY="$(vault kv get -field=value secret/audit/datadog-application-key)"\n'
     )
 
 
@@ -1496,7 +1496,7 @@ def init_envrc(
     directory.mkdir(parents=True, exist_ok=True)
     envrc.write_text(envrc_template())
     typer.echo(f'Wrote {envrc}')
-    typer.echo(f'Next: edit it to export DD_API_KEY / DD_APP_KEY, then run: direnv allow {directory}')
+    typer.echo(f'Next: review it and adjust the credential source if needed, then run: direnv allow {directory}')
 
 
 def main() -> None: