Declare live platform-admin role and policies; add attended admin check

Answers the-custodian 641673a4. An attended read-only check (receipt
docs/evidence/2026-09-23-openbao-platform-admin-check.json) found:
- live platform-admin policy = repo file + reins/* (ops-mason, 2026-07-27);
  repo now matches live (sha256 0ca5b821...). No live write.
- role also attaches operator-custody (undeclared); declared here.
- role declared as openbao/auth/netkingdom-platform-admin-role.json.
- default policy is attached and grants revoke-self/lookup-self, so the
  suspected missing grant is not the cause of warden's unconfirmed revocation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

openbao/policies/platform-admin.hcl

@@ -45,3 +45,11 @@ path "secret/*" {
 path "tenants/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
 }
+
+# reins/ -- per-rein credential secrets (glas-harness family), mount added
+# 2026-07-27 by ops-mason (MASON-WP-0001-T05). Added here so platform-admin
+# can complete paste-once-provision into any rein's path, matching every
+# other KV mount already listed in this policy.
+path "reins/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}