refactor(gitops): establish platform ownership boundaries

policies/vault/dev-k3s/platform/vault-database-automation-dev.hcl

@@ -0,0 +1,24 @@
+# Managed by vault-foundation. The database runner may reconcile only the named
+# PostgreSQL connection, dynamic role, and minimal self-service token endpoints.
+
+path "database/config/auth-system-postgres-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "database/roles/auth-db-migration-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+# no-default-policy runner tokens retain only the self-service operations used
+# for capability checks, identity verification, and explicit revocation.
+path "sys/capabilities-self" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}