fix(openbao-session): always pass -ttl so session tokens stay short-lived

Without an explicit -ttl the role path could mint ~32-day session tokens.
Pass SESSION_TTL in both role and policy modes. Bump 0.1.3.

Co-Authored-By: Claude <noreply@anthropic.com>

plugins/openbao-session/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openbao-session",
-  "version": "0.1.2+codex.20260901112838",
+  "version": "0.1.3+codex.20260901113700",
   "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
   "author": {
     "name": "Local developer"