feat(policy): add credential grant authorization package

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

examples/railiance-platform/resource_manifest.yaml

@@ -0,0 +1,44 @@
+id: railiance-platform-credential-grants
+system: railiance-platform
+resources:
+  - id: credential-grant:rapp-postgres/audit-core-runtime
+    type: credential-grant
+    owner: team:platform-security
+    attributes:
+      grant_id: rapp-postgres/audit-core-runtime
+      credential_type: openbao-database-credential
+      issuer: openbao
+      audience: audit-core
+      max_ttl_seconds: 3600
+      allowed_actor_types: [human-operator, approved-agent, ci-runner]
+      allowed_purposes: [audit-core-runtime]
+      allowed_delivery_modes: [exec-env]
+  - id: credential-grant:rapp-postgres/audit-core-migration
+    type: credential-grant
+    owner: team:platform-security
+    attributes:
+      grant_id: rapp-postgres/audit-core-migration
+      credential_type: openbao-database-credential
+      issuer: openbao
+      audience: audit-core
+      max_ttl_seconds: 1800
+      allowed_actor_types: [human-operator, approved-agent, ci-runner]
+      allowed_purposes: [audit-core-migration]
+      allowed_delivery_modes: [exec-env]
+  - id: credential-grant:ops-warden/warden-sign
+    type: credential-grant
+    owner: team:platform-security
+    attributes:
+      grant_id: ops-warden/warden-sign
+      credential_type: openbao-token
+      issuer: openbao
+      audience: ops-warden
+      max_ttl_seconds: 3600
+      allowed_actor_types: [human-operator, approved-agent, ci-runner]
+      allowed_purposes: [flex-auth-openbao-smoke, ops-warden-production-sign-smoke]
+      allowed_delivery_modes: [exec-env, response-wrap, local-token-file, kubernetes-auth]
+actions: [issue]
+caring_profile: caring-0.4.0-rc2
+metadata:
+  flex_auth_contract: resource-registration-v0
+  tenant: tenant:platform