Add logarchive gpg key

logarchiver encrypts archived logs to an OpenPGP key held in the gpg engine so
the private key never leaves Vault; retrieval delegates decryption back to
gpg/decrypt/logarchive. The service consumes only the public key, delivered to
the logging namespace as a mounted file via VSO from KV (existing logging/default
policy), so no new Vault role or read policy is needed here.

- Create gpg key logarchive (rsa-4096, non-exportable) in the gpg mount.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/gpg_key/gpg/logarchive.yaml

@@ -0,0 +1,8 @@
+# config/gpg_key/gpg/logarchive.yaml
+# OpenPGP key in the gpg engine for the logarchiver service. The private key
+# stays in Vault; logarchiver reads only the exported public key
+# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates
+# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg".
+algorithm: rsa-4096
+identity: "logarchive <logarchive@unkin.net>"
+exportable: false