Propose token self-lifecycle for the CCR-2026-0033 ESO reader

ESO validates a store with auth/token/lookup-self, and the role drops the
default policy, so the applied store failed with 403. Adds lookup-self and
revoke-self on the reader's own token, as in CCR-2026-0005 and the
keycape-factor-read lane. Needs founder approval before re-apply.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl

@@ -1,3 +1,12 @@
 path "platform/data/workloads/keycape/secrets-engine-openbao" {
   capabilities = ["read"]
 }
+
+# ESO validates its own short-lived workload session.
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}