feat(openbao-session): tie session token to the user entity

Mint the session token with -entity-alias from OPENBAO_SESSION_ENTITY so
{{identity.entity.id}} resolves and the session can read humans/self (read-only)
in addition to shared/*. Document the claude-session policy with humans/self.
Bump 0.1.1.

Co-Authored-By: Claude <noreply@anthropic.com>

plugins/openbao-session/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openbao-session",
-  "version": "0.1.0+codex.20260901021149",
+  "version": "0.1.1+codex.20260901111859",
   "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
   "author": {
     "name": "Local developer"