Grant vault deployer access to import + manage the rancher engine

The rancher token secrets engine is registered ('imported') into the catalog by
terraform-vault (sys/plugins/catalog, sudo-protected) and configured via the
ranchervaultsecret provider, so the deployer needs catalog access plus write on
the engine's config/service-accounts/roles paths. Without this, apply 403s on
plugin registration and on rancher/* writes.

- Add policies/rancher/admin.yaml granting the tf_vault approle and the
  woodpecker_terraform_vault k8s role: catalog sudo on the plugin, and manage on
  rancher/{config,service-accounts,roles}.

config/plugins/vault-plugin-secrets-rancher.yaml

@@ -1,11 +0,0 @@
-# config/plugins/vault-plugin-secrets-rancher.yaml
-# Imports (registers) the rancher secrets plugin in the catalog. Filename =
-# catalog name = mount type. The binary is installed on the OpenBao nodes by
-# Puppet (openbao-plugin-secrets-rancher RPM ->
-# /opt/openbao-plugins/vault-plugin-secrets-rancher).
-#
-# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
-# upgrade or OpenBao will refuse to launch the plugin.
-type: secret
-command: vault-plugin-secrets-rancher
-sha256: "d2b17f45b5fa9e6549443fec3ba22f17ef575d2d811c14324187dc9904ec574a"

policies/rancher/admin.yaml

@@ -0,0 +1,55 @@
+# Allow the vault deployer to import the rancher plugin and manage its engine
+# (config, seeded service accounts, and roles).
+#
+# terraform-vault registers the plugin itself (vault_plugin -> sys/plugins/catalog,
+# a sudo-protected path) and manages the engine via the ranchervaultsecret
+# provider, so the deployer needs catalog access on top of the mount access it
+# already has (sys/mounts/*). Without this, apply 403s on the plugin
+# registration and on rancher/{config,service-accounts,roles} writes.
+---
+rules:
+  # Import / register (and deregister) the rancher plugin in the catalog.
+  - path: "sys/plugins/catalog/secret/vault-plugin-secrets-rancher"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - sudo
+  # Engine connection config.
+  - path: "rancher/config"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  # Seeded, auto-rotated service-account tokens (+ manual rotate).
+  - path: "rancher/service-accounts/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+  - path: "rancher/service-accounts"
+    capabilities:
+      - read
+      - list
+  # Token-minting roles.
+  - path: "rancher/roles/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+  - path: "rancher/roles"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault