Grant the terraform-rancher runner read on rancher/creds/ci

Adds policies/rancher/creds/ci.yaml so the terraform-rancher approle and its
woodpecker k8s role can read the ci role's ephemeral Rancher token, replacing
the static 90-day admin token in kv/service/terraform/rancher.

policies/rancher/creds/ci.yaml

@@ -0,0 +1,20 @@
+# Allow the terraform-rancher runner to mint an ephemeral Rancher API token
+# from the "ci" role, so its Makefile can swap
+#   vault kv get kv/service/terraform/rancher
+# for
+#   vault read -field=token rancher/creds/ci
+# and retire the static 90-day admin token. The minted token is lease-bound
+# (ttl 1h, max 8h) and deleted from Rancher on revoke; it inherits the seeded
+# admin service account's RBAC, so this is the same privilege as the static
+# token it replaces, just short-lived.
+---
+rules:
+  - path: "rancher/creds/ci"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_rancher
+  k8s/au/syd1:
+    - woodpecker_terraform_rancher