apply-policies: fix header always showing [dry-run]

${DRY:+...} expanded on DRY=0 (non-empty). Gate the label on DRY=1 instead;
the apply logic was already correct.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/apply-policies.sh

@@ -20,7 +20,7 @@ TOKEN="${BAO_TOKEN:-}"
 # functional comparison: ignore comments and blank lines
 norm(){ grep -vE '^[[:space:]]*#' | grep -vE '^[[:space:]]*$' | sed 's/[[:space:]]*$//'; }
 
-echo "${DRY:+[dry-run] }policies under $DIR -> $ADDR"
+echo "$([ "$DRY" = 1 ] && printf '[dry-run] ')policies under $DIR -> $ADDR"
 for f in "$DIR"/*.hcl; do
   name="$(basename "$f" .hcl)"; filetxt="$(cat "$f")"
   live="$(curl -sS -H "X-Vault-Token: $TOKEN" "$ADDR/v1/sys/policies/acl/$name" \