Grant read on a transit key #587

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

A transit grant may include read (the key's public part and versions, transit/keys/<key>), beside sign|verify|encrypt|decrypt|rotate. auth-api publishes its JWKS from transit/keys/auth-api-jwt, so without read its handover keeps logging in as the old fleet-infra role auth-api (auth-api#113, workaround in the runbook). Needed before fleet-infra's Vault bootstrap can stop writing that role (estate#209).

Acceptance criteria

• read is admitted on a transit grant and renders read on transit/keys/<key> in the Project's policy.
• auth-api's project file declares it, and the runbook's old-role workaround is removed.
• Spec, worked example, schema corpus and behaviour-ledger row as usual; npm run verify passes.

Blocked by

• Split the compiler's mixed modules by concept, with no change of behaviour