feat(openbao-session): tie session token to the user entity

Mint the session token with -entity-alias from OPENBAO_SESSION_ENTITY so
{{identity.entity.id}} resolves and the session can read humans/self (read-only)
in addition to shared/*. Document the claude-session policy with humans/self.
Bump 0.1.1.

Co-Authored-By: Claude <noreply@anthropic.com>

plugins/openbao-session/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openbao-session",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
   "author": { "name": "Senkensha" },
   "hooks": "./hooks/claude-codex-hooks.json"