The vault resource needs to expose a capability that requires the picketbox package

The picketbox module is optional in core, but there is no link from configuration to a hard requirement for PB. The result is Galleon could theoretically provision a server with a vault in the config but not PB module on the FS. The way to add such a link is via a capability for vault and the use of RuntimeCapability.Builder.addAdditionalRequiredPackages.

Note that I think this means the vault feature can't be part of any layer in core, or at least not a layer that's depended upon by any 'default' core layer. This is because the PB module will not be part of the core feature pack.

jfdenise_jira FYI; this is a follow up to our conversation earlier today.