Propose token self-lifecycle for the CCR-2026-0033 ESO reader

ESO validates a store with auth/token/lookup-self, and the role drops the
default policy, so the applied store failed with 403. Adds lookup-self and
revoke-self on the reader's own token, as in CCR-2026-0005 and the
keycape-factor-read lane. Needs founder approval before re-apply.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

credential-change-requests/CCR-2026-0033.yaml

@@ -61,6 +61,7 @@ openbao:
   policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
   policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
   metadata_read: false
+  token_self_lifecycle: true
   auth:
     method: kubernetes
     mount: kubernetes

openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl

@@ -1,3 +1,12 @@
 path "platform/data/workloads/keycape/secrets-engine-openbao" {
   capabilities = ["read"]
 }
+
+# ESO validates its own short-lived workload session.
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}