Implement KeyCape provider and service identity contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

config/service-clients.example.yaml

@@ -0,0 +1,26 @@
+# Non-secret static registration fragments for KeyCape's bounded OpenBao JWT
+# consumers. Merge these entries into the deployment-owned KeyCape config.
+# The named environment variables must be materialized by an approved
+# out-of-repository custody path; this file never contains their values.
+clients:
+  - clientId: "codex-railiance-platform"
+    displayName: "Railiance platform coding agent"
+    allowedScopes: ["openbao:login"]
+    grantTypes: ["client_credentials"]
+    clientType: "confidential"
+    secretRef: "env:KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
+    serviceSubject: "service:codex:railiance-platform"
+    tenant: "tenant:coulomb"
+    roles: ["coding-agent"]
+    tokenLifetime: "15m"
+
+  - clientId: "secrets-engine-openbao"
+    displayName: "secrets-engine OpenBao login"
+    allowedScopes: ["openbao:login"]
+    grantTypes: ["client_credentials"]
+    clientType: "confidential"
+    secretRef: "env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET"
+    serviceSubject: "service:secrets-engine"
+    tenant: "tenant:coulomb"
+    roles: ["secrets-engine"]
+    tokenLifetime: "15m"