Two clients update the same KV v2 secret. The team wants to reject writes based on a stale version. Which feature fits?

1. Check-and-set using the expected secret version
2. A longer secret path without version checks
3. A global root token shared by both writers
4. A shorter client connection timeout