openbao-apply-ssh-engine: role writer passed 'bao' twice (exit 127)

The exec wrapper already runs bao; the role command prefixed another
'bao', so every role write failed with usage text and no role was ever
written by this script (found during CUST-WP-0073 step 1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61

scripts/openbao-apply-ssh-engine.sh

@@ -189,7 +189,8 @@ spec = yaml.safe_load(open(spec_path))
 roles = spec.get("roles") or {}
 for role_name, params in roles.items():
     args = [f"{k}={v}" for k, v in params.items()]
-    cmd = ["bao", "write", f"{mount}/roles/{role_name}"] + args
+    # The exec wrapper below already runs `bao`; pass only its arguments.
+    cmd = ["write", f"{mount}/roles/{role_name}"] + args
     proc = subprocess.run(
         kubectl_parts + ["exec", "-i", "-n", namespace, pod, "--", "sh", "-c",
          "read -r BAO_TOKEN; export BAO_TOKEN; exec bao \"$@\"", "sh"] + cmd,