Admit and install the backup pair writer.

The OpenBao policy matches the reviewed file. Both publisher KV paths are still empty because the bootstrap key cannot create IAM applications.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54

scripts/application_backup_pair_custody.py

@@ -18,7 +18,9 @@ from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 FIELDS = ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY")
 WRITER_POLICY = "backup-pair-writer"
-WRITER_ADMITTED = False
+# Founder admission 2026-10-08. The installed OpenBao policy matches
+# openbao/policies/backup-pair-writer.hcl. The CLI still does not write.
+WRITER_ADMITTED = True
 PROFILES = {
     "coulomb-social": "CCR-2026-0036",
     "email-connect": "CCR-2026-0037",