Grant terraform-rancher read on rancher/creds/ci (#143)

## Why

`terraform-rancher` authenticates the rancher2 provider with a static 90-day admin API token stored in `kv/service/terraform/rancher` — the repo carries its own Makefile TODO to retire it. The Rancher secrets engine is already mounted at `rancher/` with a `ci` role (seeded `admin` service account, ttl 1h / max 8h), but no policy grants read on `rancher/creds/*`, so nothing can use it yet.

## What

Adds `policies/rancher/creds/ci.yaml`: `read` on `rancher/creds/ci`, bound to the same runner identities as the existing kv policy — approle `terraform_rancher` and k8s/au/syd1 role `woodpecker_terraform_rancher`.

Minted tokens are lease-bound and deleted from Rancher on revoke. They inherit the seeded admin service account's RBAC, so this is the same privilege as the static token it replaces, just short-lived.

## Follow-up

A terraform-rancher Makefile PR swapping `vault kv get kv/service/terraform/rancher` for `vault read -field=token rancher/creds/ci` must merge **only after** this one applies.

Reviewed-on: #143
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

policies/rancher/creds/ci.yaml

@@ -0,0 +1,20 @@
+# Allow the terraform-rancher runner to mint an ephemeral Rancher API token
+# from the "ci" role, so its Makefile can swap
+#   vault kv get kv/service/terraform/rancher
+# for
+#   vault read -field=token rancher/creds/ci
+# and retire the static 90-day admin token. The minted token is lease-bound
+# (ttl 1h, max 8h) and deleted from Rancher on revoke; it inherits the seeded
+# admin service account's RBAC, so this is the same privilege as the static
+# token it replaces, just short-lived.
+---
+rules:
+  - path: "rancher/creds/ci"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_rancher
+  k8s/au/syd1:
+    - woodpecker_terraform_rancher