feat: founder ingest of local scaleway.auto.tfvars

Parse the four Terraform fields and bao kv put via @file. Never
print values. Operator runs this; agents do not.

tools/ingest-scaleway-tfvars.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Founder-only. Reads a local scaleway.auto.tfvars (or equivalent) and
+# writes the four fields to OpenBao. Never prints values. Never commit
+# the tfvars file.
+set -euo pipefail
+
+TFVARS="${1:-}"
+[[ -n "$TFVARS" && -f "$TFVARS" ]] || {
+  echo "usage: $0 /path/to/scaleway.auto.tfvars" >&2
+  exit 2
+}
+command -v bao >/dev/null || { echo "missing bao" >&2; exit 2; }
+
+mapfile -t EXPORTS < <(python3 - "$TFVARS" <<'PY'
+import re, json, sys
+text = open(sys.argv[1], encoding="utf-8").read()
+# HCL-ish: key = "value"  (ignore comments and the main.tf provider block)
+found = {}
+for name, dest in (
+    ("access_key", "ACCESS_KEY"),
+    ("secret_key", "SECRET_KEY"),
+    ("organization_id", "DEFAULT_ORGANIZATION_ID"),
+    ("project_id", "DEFAULT_PROJECT_ID"),
+):
+    m = re.search(rf'(?m)^\s*{name}\s*=\s*"([^"]*)"\s*$', text)
+    if not m or not m.group(1) or m.group(1) in {"xxx", "redacted"}:
+        sys.stderr.write(f"missing or placeholder field: {name}\n")
+        sys.exit(4)
+    found[dest] = m.group(1)
+for dest, val in found.items():
+    print(f"{dest}={json.dumps(val)}")
+PY
+)
+
+# Write via env to bao without putting values on argv.
+# bao kv put supports @file; we use a mode-0600 temp dir.
+umask 077
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+for line in "${EXPORTS[@]}"; do
+  field="${line%%=*}"
+  python3 -c 'import json,os,sys; open(sys.argv[2],"w").write(json.loads(sys.argv[1]))' \
+    "${line#*=}" "$tmp/$field"
+done
+
+bao kv put platform/workloads/railiance/scaleway/bootstrap \
+  ACCESS_KEY=@"$tmp/ACCESS_KEY" \
+  SECRET_KEY=@"$tmp/SECRET_KEY" \
+  DEFAULT_ORGANIZATION_ID=@"$tmp/DEFAULT_ORGANIZATION_ID" \
+  DEFAULT_PROJECT_ID=@"$tmp/DEFAULT_PROJECT_ID"
+
+echo "wrote four fields to platform/workloads/railiance/scaleway/bootstrap"
+bao kv metadata get platform/workloads/railiance/scaleway/bootstrap
+echo "shred or keep your tfvars; do not commit it"