Add scenario tests for the keypair resource policy

## Goal

The keypair policy chapter of api/adapters/resource_policy/KNOWLEDGE.md and the scenario tests under tests/scenario/bai_scenario/manager/resource_policy that match it one for one, with the report.md the run produces.

## Background

BA-7809 researched the resource policy adapter — one adapter over the keypair, user and project policies, 17 public calls over 20 wirings — and wrote its scenarios. Each policy gets its own chapter of api/adapters/resource_policy/KNOWLEDGE.md and its own PR, self-contained: the shared frame of the scenario component (the Family class, the givens and thens, the adapter conftest) is carried in every one of the three, and whichever merges first lands it.

The keypair policy is the widest of the three: three optional values on create, the same three nullable on update, a priority cap the session priority range bounds, a search filtered by the user whose keypair holds the policy, and a call that reads the caller's own policy through the default-marked key. Its calls are create, get, search, update, purge and get-my — six.

## Acceptance criteria

- KNOWLEDGE.md holds the intro every policy shares and the keypair policy chapter: creating, reading by name, searching, editing, purging, reading one's own.
- Every row is a scenario in tests/scenario; every one of the six calls is reached; test-scenario and verify-scenario-report pass on CI.
- A keypair seed lays one more key under an existing user, never marked default, so the rows about several keys and an inactive default key can be laid.
- No file under tests/scenario/bai_scenario/runner, seeder.py, components/answers.py or an existing seed changes.

## Related

- BA-7809 (the research)
- BA-7839, BA-7841 (behaviours the rows pin as they are today)

JIRA Issue: BA-7852

Read api/adapters/resource_policy/KNOWLEDGE.md and the matching files under tests/scenario/bai_scenario/manager/resource_policy, using BA-7809 and the related behavior issues as context. Add the keypair chapter, six-call scenarios, and a keypair seed without changing the excluded runner, seeder.py, components/answers.py, or existing seeds. Run test-scenario and verify-scenario-report; done means the report and CI checks pass.

Written by the indexing model from the issue text.