Add logarchive gpg key

logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so
the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. The service consumes only the public key, delivered to
the logging namespace as a mounted file via VSO from KV (existing logging/default
policy), so no new Vault role or read policy is needed here.

- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/auth_kubernetes_role/k8s/au/syd1/logarchiver.yaml

@@ -1,7 +0,0 @@
-bound_service_account_names:
-  - logarchiver
-bound_service_account_namespaces:
-  - logging
-token_ttl: 600
-token_max_ttl: 600
-audience: vault

policies/gpg/logarchive_public_read.yaml

@@ -1,12 +0,0 @@
-# Allow the logarchiver service (logging namespace) to read the logarchive
-# public key. A plain read on gpg/keys/<name> returns the armored public_key;
-# no decrypt/export capability is granted.
----
-rules:
-  - path: "gpg/keys/logarchive"
-    capabilities:
-      - read
-
-auth:
-  k8s/au/syd1:
-    - logarchiver