Separate fail-closed bootstrap from narrow policy rotation
A declarative bootstrap that creates missing resources and fails closed on drift should not be reused to rotate an existing Cloudflare Access policy's service-token ID: refusing drift is its safety contract. Use a separate, narrowly scoped rotator that GETs the current policy, va…