Add governance blueprint: policy-as-code, operator/auditor, identity setup

Reviewable governance scaffolding — NOTHING applied to live OpenBAO yet:

- policies/: materialize all existing policies as code (faithfully fetched
  from live) + new `operator` (use engines, no admin) and `auditor`
  (read-only governance visibility, no secret material)
- scripts/apply-policies.sh: idempotent policy-as-code apply, with a
  read-only --dry-run that diffs files vs live (ignores comments)
- scripts/setup-identity.sh: identity-as-code — policy-bound groups
  (g-admins/operators/auditors/personal) + a human entity/alias; DEFAULT
  DRY-RUN, --apply to execute
- GOVERNANCE.md: the layered model, policy catalog, naming, apply order,
  and cross-cutting controls (audit device, root offline, AppRole migration)

Dry-runs verified read-only: apply-policies shows operator/auditor as NEW,
all others unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

policies/auditor.hcl

@@ -0,0 +1,24 @@
+# auditor — read-only governance visibility. Can see HOW the system is
+# configured and WHO can do what, but CANNOT read any secret material and
+# CANNOT change anything. The independent "governance lens".
+
+# Configuration visibility
+path "sys/health"           { capabilities = ["read"] }
+path "sys/seal-status"      { capabilities = ["read"] }
+path "sys/mounts"           { capabilities = ["read"] }
+path "sys/auth"             { capabilities = ["read"] }
+path "sys/metrics"          { capabilities = ["read"] }
+
+# Policy visibility (read the rules, not change them)
+path "sys/policies/acl"     { capabilities = ["list"] }
+path "sys/policies/acl/*"   { capabilities = ["read"] }
+
+# Identity visibility (who exists) — names only, not secrets
+path "identity/entity/name" { capabilities = ["list"] }
+path "identity/group/name"  { capabilities = ["list"] }
+
+# Audit device configuration visibility (sudo required for this path)
+path "sys/audit"            { capabilities = ["read", "sudo"] }
+
+# NOTE: intentionally NO `secret/`, `personal/`, `pki*`, `ssh/`, `transit*`
+# data paths — an auditor reviews governance, not secrets.