RPF-WP-0054-T05: fix issuer binding after the first probe

CCR-2026-0043 applied cleanly, but generate could not mint the grant token
(OpenBao refuses child tokens from a limited-use token; the role had
token_num_uses 8) and revoke-self was denied (missing from the issuer
policy). The role now uses 0, which the validator requires, and the issuer
policy grants revoke-self. Nothing was written by the probe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

openbao/auth/credential-broker-keycape-client-secret-generate-oidc-role.json

@@ -18,6 +18,6 @@
   "token_ttl": "15m",
   "token_max_ttl": "15m",
   "token_explicit_max_ttl": "15m",
-  "token_num_uses": 8,
+  "token_num_uses": 0,
   "verbose_oidc_logging": false
 }

openbao/policies/credential-broker-keycape-client-secret-generate-issuer.hcl

@@ -12,6 +12,9 @@ path "auth/token/revoke-accessor" {
 path "auth/token/lookup-self" {
   capabilities = ["read"]
 }
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}
 path "sys/capabilities-self" {
   capabilities = ["update"]
 }