vault: move openbao plugin sockets off /tmp onto a /run RuntimeDirectory

go-plugin creates each secrets plugin's control socket under the process
TMPDIR (/tmp/pluginNNN by default). The daily systemd-tmpfiles-clean
deletes aged /tmp files, severing the socket of a long-lived plugin while
its process keeps running, so every request fails with rpc Unavailable /
dial unix /tmp/pluginNNN: no such file until a reload respawns it. This
took out the litellm engine (terraform-vault#112); the risk is shared by
every OpenBao plugin (gpg, rancher, gitea, ...).

Add a vault.service drop-in setting TMPDIR to a per-start RuntimeDirectory
on /run (tmpfs, no age-based cleanup), so plugin sockets can never be
reaped. The drop-in notifies a vault restart so the new TMPDIR takes
effect and plugins respawn with sockets under /run.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

site/profiles/manifests/vault/server.pp

@@ -130,6 +130,20 @@ class profiles::vault::server (
       mode   => '0600',
     }
 
+    # go-plugin creates each secrets plugin's control socket under TMPDIR
+    # (/tmp/pluginNNN by default); systemd-tmpfiles-clean reaps aged /tmp files
+    # and severs the socket of a long-lived plugin, orphaning the process. Point
+    # TMPDIR at a per-start RuntimeDirectory on /run (tmpfs, no age cleanup).
+    systemd::manage_dropin { 'plugin-tmpdir.conf':
+      unit          => 'vault.service',
+      service_entry => {
+        'RuntimeDirectory'     => 'vault-plugins',
+        'RuntimeDirectoryMode' => '0700',
+        'Environment'          => 'TMPDIR=/run/vault-plugins',
+      },
+      notify        => Service['vault'],
+    }
+
     service { 'vault':
       ensure    => true,
       enable    => true,