#What's Changed

[Fix] apivault run and apivault env export take their environment from the token's pin when no --env is given, so a pipeline needs no configuration of its own. Previously they sent the local config's environment, which a pinned token refused, and failed outright in a fresh container with no config. An explicit --env still wins, which keeps a contradiction visible as an error rather than quietly reading the wrong environment.
[Improvement] A rejected service token no longer suggests apivault login, which refuses to run in that state. An unrecognised APIVAULT_TOKEN now says the value did not match a token — the usual cause being a truncated copy or a secret set on the wrong repository — while expiry, revocation and IP denials continue to name themselves exactly.
[Improvement] apivault projects list and apivault logs refuse up front under a service token instead of returning an authentication error indistinguishable from a bad credential. One spans every project on the account; the other is the audit trail that records machine access rather than exposing it.
[Improvement] apivault whoami always states a service token's environment reach: a pinned token reads "Production only", an unpinned one "All environments" rather than staying silent about how far it reaches.
[Fix] apivault keys add no longer prompts when there is no terminal to prompt on. It previously asked for optional notes even with every flag supplied, so a pipeline step hung until it was killed and no key was created. Missing values are now reported by flag name, --environment falls back to the token's environment pin, and keys update — which prompts for every field and has no flag equivalent — says it needs a terminal instead of aborting on a closed input.
[Fix] apivault keys delete without -f no longer stalls on its confirmation prompt in an unattended shell. It refuses and names the flag instead: deleting cannot be undone, so an absent human is not read as agreement. A command that needs a custom vault key it cannot prompt for now points at --vault-key and APIVAULT_KEY rather than waiting on input that will never arrive.
[Improvement] The README documents headless use: creating a service token, which commands support it, environment pinning, and GitHub Actions and Docker examples.