feat(vault-auth): migrate to crossplane v2 + opentofu via fn-kcl

[patrick-hermann-sva]

Summary

Replaces the legacy tf.upbound.io + function-go-templating implementation of bootstrap/vault-auth with a Crossplane v2 namespaced composition that delegates rendering to the xplane-vault-auth KCL module (pulled from OCI by function-kcl).

Source pinned: oci://ghcr.io/stuttgart-things/xplane-vault-auth:0.3.1

Changes

• XRD (apis/definition.yaml): apiextensions.crossplane.io/v1 → v2, scope: Namespaced, all fields camelCase, new backendConfig / kubernetesHost / boundServiceAccountNames fields.
• Composition (apis/composition.yaml): single function-kcl step + function-auto-ready. No more inline HCL.
• Provider: provider-terraform → upbound/provider-opentofu:v1.0.3.
• ProviderConfig: tf.upbound.io/v1beta1 ProviderConfig → opentofu.m.upbound.io/v1beta1 ClusterProviderConfig.
• Vault token Secret: plain HCL terraform.tfvars, co-located with the XR namespace (v2 secretKeyRef is namespace-local; previous JSON + cross-namespace ref is gone).
• examples/function.yaml: function-go-templating → function-kcl + function-auto-ready.
• README rewritten with new spec table + migration notes.
• Removed stale claim variants and tf.upbound.io-era test workspaces.

Breaking changes (claim shape)

• cluster_name → clusterName, vault_addr → vaultAddr, k8s_auths → k8sAuths, token_policies → tokenPolicies, token_ttl → tokenTtl
• per-auth namespace field replaced by boundServiceAccountNamespaces[]
• cross-namespace secretRef removed; Vault token Secret must live in the XR's namespace
• providerConfigRef split into providerConfigName + providerConfigKind

See examples/claim.yaml for the new shape.

Test plan

• KCL module renders correctly for both plain + backendConfig shapes (verified in the kcl repo)
• Apply XRD + Composition against a Crossplane v2 cluster with provider-opentofu installed
• Apply examples/claim.yaml and confirm Workspaces reach Ready
• Verify the Vault auth backend is reachable (e.g. vault login -method=kubernetes ...)

Generated with Claude Code