Vault token rotation may not be right

[suprjinx]

Astral assumes it's started with a very powerful vault token (such as root) and then rotates to a more limited token.

I don't think this is quite right, since if vault is started with an already-limited token, it may not be able to rotate itself. Also, the policy we create and apply at rotation should always be applied whether or not the token is rotated.