A rendered Vault auth role carries no token lifetime #258

What is wrong

The vault-policy adapter writes each identity's Kubernetes auth role with its bound ServiceAccount, its namespace and its one policy, and no token lifetime. A token issued through such a role lives for the auth mount's default, which is Vault's system default unless the platform's fixture sets one: far longer than any pod needs a login for.

The hand-written auth tree carried token_ttl: 1h as goal state. It left the repository when the renderer's own output replaced that tree (#200), which is where the difference showed. The Vault policy job's own role is a platform fixture and is not affected.

What to decide

• Whether the role carries a token_ttl and a token_max_ttl, and whether the value is fixed in the spec or stated once in the Platform document.
• Whether a migration identity, which logs in once per Job, takes a shorter one than a Process that renews.

Acceptance criteria

• Chapter 30 says what lifetime a rendered role carries and where the value comes from.
• Every rendered role document carries it, in both implementations and every committed tree.
• delivery's vault-policy validator accepts the field and nothing wider.

Part of #195.