feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02

- Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under
  packagemanager: bun (no npm fallback needed).
- bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig()
  fails closed, aggregating all missing+malformed keys in one error. Reads flat
  dotted keys; image digests excluded (they live in VERSIONS, D5).
- bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host,
  .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0
  resources under the passphrase provider via gitignored file:// state backend.
- Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only,
  logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed
  verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained.

Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/pulumi-vault/policy.ts

@@ -0,0 +1,72 @@
+export const adminPolicyContent = `
+# Manage auth methods broadly across Vault
+path "auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+# Create, update, and delete auth methods
+path "sys/auth/*" {
+  capabilities = ["create", "update", "delete", "sudo"]
+}
+
+# List auth methods
+path "sys/auth" {
+  capabilities = ["read"]
+}
+
+# Create and manage ACL policies
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+# List ACL policies
+path "sys/policies/acl" {
+  capabilities = ["list"]
+}
+
+# Create and manage secrets engines broadly across Vault.
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+# List enabled secrets engines
+path "sys/mounts" {
+  capabilities = ["read", "list"]
+}
+
+# List, create, update, and delete key/value secrets at secret/
+path "secret/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+# Manage transit secrets engine
+path "transit/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+# Read health checks
+path "sys/health" {
+  capabilities = ["read", "sudo"]
+}
+
+path "*/metadata" {
+  capabilities = ["create", "update", "read", "delete",  "list"]
+}
+
+path "*/metadata/*" {
+  capabilities = ["create", "update", "read", "delete",  "list"]
+}
+
+path "*/data" {
+  capabilities = ["create", "update", "read", "delete",  "list"]
+}
+
+path "*/data/*" {
+  capabilities = ["create", "update", "read", "delete",  "list"]
+}
+
+path "*" {
+  capabilities = ["create", "update", "read", "delete",  "list"]
+}
+
+`;