feat: daily CNPG Option A backup shell activity (RAILIANCE-WP-0016)

Add cnpg_option_a_backup resolver, disabled ActivityDefinition, ESO
manifest, worker kubeconfig hostPath, databases RBAC, and unit tests.
Enable after ESO token re-mint and host kubeconfig wiring.

activity-definitions/daily-cnpg-option-a-backup.md

@@ -0,0 +1,50 @@
+---
+id: daily-cnpg-option-a-backup
+name: Daily CNPG Option A Backup
+enabled: false
+owner: custodian-agent
+governance: custodian
+status: active
+trigger:
+  type: cron
+  cron_expression: "30 2 * * *"
+  timezone: UTC
+  misfire_policy: skip
+context_sources:
+  - type: shell
+    query: cnpg_option_a_backup
+    required: true
+    params:
+      backup_script: /opt/railiance-platform/tools/cmd/cnpg-option-a-backup
+      dry_run: false
+      timeout_seconds: 7200
+      kubeconfig_r01: /kube/config-hosteurope
+      kubeconfig_core: /kube/config
+      evidence_sinks:
+        - type: state-hub-progress
+          event_type: cnpg_option_a_backup
+          author: activity-core
+    bind_to: context.backup
+---
+
+# Daily CNPG Option A Backup
+
+Runs daily at **02:30 UTC** (RPO 24h). Invokes
+`railiance-platform/tools/cmd/cnpg-option-a-backup` on the railiance01
+activity-core worker to age-encrypt logical dumps and upload to Nextcloud.
+
+**Workplan:** `RAILIANCE-WP-0016` (railiance-apps).
+
+## Enable checklist
+
+1. Vendor tools on railiance01 hostPath tree:
+   `tools/cmd/install-cnpg-backup-vendor-tools` (age + kubectl).
+2. ExternalSecret `actcore-backup-offsite` synced into `actcore-runtime-secret`
+   (`NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PUBLIC_KEY`).
+3. Worker mounts: `/opt/railiance-platform`, `/kube` (host kubeconfigs).
+4. CoulombCore kubeconfig present at `/kube/config` for Core clusters; R01 at
+   `/kube/config-hosteurope`.
+5. `enabled: true` + `make sync` / schedule reconcile on railiance01.
+6. Forced run succeeds; `make cnpg-backup-status` stays healthy.
+
+**Starts disabled** until T02–T04 wiring is verified on railiance01.