[ExtraToast]

Summary

auth-api's project file moves onto deploy-kit 1.0, so its next fragment publishes at the model the estate will compose on.

• observability.alertClass is dropped. 1.0 removed it; it goes in this change, not earlier (fix(deploy): drop alertClass, which deploy-kit 1.0 removes #116 was reverted by revert: keep alertClass until the toolkit is deploy-kit 1.0 #118 for that reason).
• VAULT_KUBERNETES_ROLE=${identity:vaultRole}. On 1.0, a Process holding a delivery: self grant (the transit key auth-api-jwt) wires its own Vault client, or it is E_SELF_WITHOUT_VAULT_CLIENT. The placeholder resolves to auth-system-auth-api.
• Publish Fragment is now at v0.36.0, which validates and packs with deploy-kit 1.0.0.

To know

• The role already exists. On 2026-10-27, the estate path's hourly vault-policy job in auth-system completed (14:00 UTC) with its render's policy and role unchanged. Its stale-entries list names every other namespace's <namespace>-<identity> roles and nothing in auth-system.
• Until the estate moves onto 1.0 (Move the estate onto deploy-kit 1.0 estate#231), the estate's older composer holds auth at its last composed fragment. This release changes no live object before then.

Test plan

• deploy-kit validate deploy/auth.project.yml deploy/env on deploy-kit main (1.0.0): accepted (3 read)
• After the release: pull the fragment by digest and read schemaVersion 1.0.0 back

Part of JorisJonkers-dev/deploy-kit#195.
Closes #119