Merge pull request 'ci: mint rancher token from the vault rancher engine' (#9) from benvin/ephemeral-runner-creds into main

Reviewed-on: #9

README.md

@@ -107,13 +107,10 @@ make format  # fmt tofu + terragrunt hcl
 
 ### Authentication
 
-The rancher2 provider needs a Rancher admin API token, read from Vault at
-`kv/service/terraform/rancher` (field `token`).
-
-> **Note:** Rancher API tokens have a **90-day maximum** lifetime, so the static
-> token must be rotated. This is intended to move to a dedicated Vault Rancher
-> secrets engine that mints short-lived tokens on demand; when that lands, update
-> the Makefile `vault_env` helper to `vault read` from that engine.
+The rancher2 provider needs a Rancher API token, minted on demand by the Vault
+Rancher secrets engine at `rancher/creds/ci`. The token is ephemeral (1h lease)
+and Vault revokes it in Rancher when the lease expires, so nothing needs
+rotating.
 
 Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes`
 for CI (Woodpecker).