Slice 3b: render auth, with its migration Jobs and identity

Parent

auth's rendered tree:

Migration.
- The up and down Jobs are named <application>-migration-<12 hex> and <application>-migration-down-<12 hex>, rendered suspended and applied once; the runner's tag is the same 12 hex digits.
- The runner gets up <tag> or down <tag>, plus fixed variables: database host and port, database name <project>_db, Secret Store address, Vault role, and owner credential path database/creds/<project>-owner.
- The migration identity <application>-migration gets its own policy and role (SC-34).
Replicas and disruption. Replicas above one become an HPA named by the Canary; a PodDisruptionBudget selects <name>-primary.
Grants. auth's transit and self grants render as policies.

auth's share of the tree and its _estate share equal committed golden trees byte for byte.
The manifest lint validates every object, and the runner contract matches chapter 55.

Handover from JorisJonkers-dev/liquibase-runner#1 (merged in JorisJonkers-dev/liquibase-runner#3), for the migration Jobs this slice renders:

A writable /tmp. The runner writes one file, its own changelog, under /tmp. It runs with a read-only root filesystem (the integration test runs it that way), so the Job needs /tmp and nothing else writable.
The ServiceAccount token must be mounted. The runner presents it to Vault's Kubernetes auth at auth/kubernetes/login, as VAULT_ROLE, and reads VAULT_CREDENTIALS_PATH. It reads the six variables chapter 55 lists and no others from the render.
up <tag> and down <tag> take the 12 hex digits and refuse anything else.
Two settings live in the image, not the render: CHANGELOG_FILE (default changelog.yaml, set by an application whose changesets are already recorded under another name) and LOCK_STALE_AFTER (default 30m). If the platform's migration.deadline ever exceeds 30 minutes, the second one has to move with it; chapter 55 does not name either today.
No image is published yet. The first release PR on liquibase-runner has to merge before the images lock can resolve liquibase-runner to a digest.