Why:
- The netbox secrets engine cannot be mounted until its plugin binary is
registered in the OpenBao catalog, so the catalog entry must land before any
engine mount or role config references it.
How:
- Add config/plugins/vault-plugin-secrets-netbox.yaml registering the plugin as
a secret plugin, pinned to the released v0.1.0 binary sha256 that Puppet
installs on the OpenBao nodes. Bump the sha in lockstep with any RPM upgrade.