Modernizing Legacy Apps: Zero Trust Secret Injection with Vault Agent

Act as a Legacy Modernization Architect. Devise a highly tactical strategy to drag a vulnerable, monolithic [LEGACY_LANGUAGE] (e.g., PHP 5.6 or Java 8) application kicking and screaming into a modern Zero Trust architecture utilizing HashiCorp Vault Agent. The application currently resides on a rigid [DEPLOYMENT_TYPE] (e.g., bare-metal Linux or VMWare VMs) and tragically utilizes hardcoded, plaintext [SECRET_TYPE] (e.g., database connection strings) buried deep in configuration files. You must explain, step-by-step, exactly how to deploy the Vault Agent daemon utilizing 'Auto-Auth' (AppRole or AWS IAM) to authenticate the VM, and configure `consul-template` logic to dynamically intercept, render, and inject ephemeral secrets directly into the application's local environment files (e.g., `.env`) strictly on-the-fly, mathematically guaranteeing zero modifications to the fragile, legacy application source code. Provide a flawless example of the required `vault-agent.hcl` template payload.