RPF-WP-0054-T05: fix issuer binding after the first probe

CCR-2026-0043 applied cleanly, but generate could not mint the grant token
(OpenBao refuses child tokens from a limited-use token; the role had
token_num_uses 8) and revoke-self was denied (missing from the issuer
policy). The role now uses 0, which the validator requires, and the issuer
policy grants revoke-self. Nothing was written by the probe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

scripts/broker_grant_lane.py

@@ -86,6 +86,7 @@ def generated_issuer_hcl(ccr: dict[str, Any]) -> str:
         ("auth/token/lookup-accessor", '"update"'),
         ("auth/token/revoke-accessor", '"update"'),
         ("auth/token/lookup-self", '"read"'),
+        ("auth/token/revoke-self", '"update"'),
         ("sys/capabilities-self", '"update"'),
     ):
         lines += [f'path "{path}" {{', f"  capabilities = [{caps}]", "}"]

scripts/issuer_binding_lane.py

@@ -69,6 +69,10 @@ def validate(ccr: dict[str, Any], repo_dir: Path) -> list[str]:
     role = _matrix._shared._load_json(repo_dir, str(auth.get("role_file") or ""), "openbao.auth.role_file", errors)
     if role:
         _matrix._validate_role(role, issuer, errors)
+        # OpenBao refuses child-token creation from a limited-use token, and
+        # minting the grant token is this role's whole purpose (probe 2026-10-10).
+        if role.get("token_num_uses") != 0:
+            errors.append("role token_num_uses must be 0: limited-use tokens cannot create child tokens")
     return errors