Add governance blueprint: policy-as-code, operator/auditor, identity setup

Reviewable governance scaffolding — NOTHING applied to live OpenBAO yet:

- policies/: materialize all existing policies as code (faithfully fetched
  from live) + new `operator` (use engines, no admin) and `auditor`
  (read-only governance visibility, no secret material)
- scripts/apply-policies.sh: idempotent policy-as-code apply, with a
  read-only --dry-run that diffs files vs live (ignores comments)
- scripts/setup-identity.sh: identity-as-code — policy-bound groups
  (g-admins/operators/auditors/personal) + a human entity/alias; DEFAULT
  DRY-RUN, --apply to execute
- GOVERNANCE.md: the layered model, policy catalog, naming, apply order,
  and cross-cutting controls (audit device, root offline, AppRole migration)

Dry-runs verified read-only: apply-policies shows operator/auditor as NEW,
all others unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

policies/operator.hcl

@@ -0,0 +1,33 @@
+# operator — day-to-day USE of secrets engines, but NO administration.
+# Deliberately cannot manage mounts, auth methods, policies, or identity, and
+# has no access to the personal/ or transit-personal/ trust domains. This is
+# the policy a human should hold for routine work instead of full `admin`.
+
+# KV v2 data (shared secrets)
+path "secret/data/*"        { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
+path "secret/metadata/*"    { capabilities = ["read", "list", "delete"] }
+
+# PKI: issue/sign leaf certs (NOT manage the CA)
+path "pki_int/issue/*"      { capabilities = ["update"] }
+path "pki_int/sign/*"       { capabilities = ["update"] }
+path "pki/issue/*"          { capabilities = ["update"] }
+
+# SSH: sign user/host certs (NOT manage the CA or roles)
+path "ssh/sign/*"           { capabilities = ["update"] }
+
+# Transit: use existing keys (NOT create/rotate/delete)
+path "transit/encrypt/*"    { capabilities = ["update"] }
+path "transit/decrypt/*"    { capabilities = ["update"] }
+
+# TOTP codes
+path "totp/code/*"          { capabilities = ["create", "read", "update"] }
+
+# Read-only operational visibility
+path "sys/mounts"           { capabilities = ["read"] }
+path "sys/health"           { capabilities = ["read"] }
+path "sys/seal-status"      { capabilities = ["read"] }
+
+# Token self-management
+path "auth/token/lookup-self" { capabilities = ["read"] }
+path "auth/token/renew-self"  { capabilities = ["update"] }
+path "auth/token/revoke-self" { capabilities = ["update"] }