Ordered add registers the plugin in the catalog (#123) before this PR mounts +
configures the engine. This PR is now mount/config/role + module wiring only.
Ordered plugin add requires the config-write policy to be effective in a prior
apply before this PR writes ghp/config. Policies now live in #122; this PR is
resources-only (catalog entry, backend config, role, modules, config.hcl wiring).
Registers the vault-plugin-secrets-ghp catalog entry, mounts the ghp
engine, defines an agent token-minting role, and grants the deployer +
agents AppRole the matching policies. Modeled on the netbox engine,
dropping the rotate/user-management machinery ghp does not have.
unkin-agent