OpenBao agt-role: allow permit-pty extension for agt-custodian (CUST-WP-0073-T02, WARDEN-WP-0045)

Without allowed_extensions, OpenBao refuses warden's explicit
extensions={permit-pty} request for the supervised agent profile.
Applied later through scripts/openbao-apply-ssh-engine.sh (attended).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61

openbao/ssh/roles-spec.yaml

@@ -18,6 +18,8 @@ roles:
     allow_user_certificates: true
     allow_user_key_ids: true
     default_user: agt
+    # CUST-WP-0073 / WARDEN-WP-0045: agt-custodian requests permit-pty explicitly.
+    allowed_extensions: "permit-pty"
     ttl: 24h
     max_ttl: 24h
   atm-role: