feat: daily CNPG Option A backup shell activity (RAILIANCE-WP-0016)

Add cnpg_option_a_backup resolver, disabled ActivityDefinition, ESO
manifest, worker kubeconfig hostPath, databases RBAC, and unit tests.
Enable after ESO token re-mint and host kubeconfig wiring.

k8s/railiance/15-externalsecret-backup-offsite.yaml

@@ -0,0 +1,41 @@
+# Sync Option A offsite backup credentials into actcore-runtime-secret.
+#
+# Prereqs on railiance01:
+#   - ClusterSecretStore openbao-activity-core
+#   - ESO token includes policy workload-kv-read-railiance-backup-offsite-lane
+#     (scripts/openbao-eso-token-apply.sh defaults updated in RAILIANCE-WP-0016)
+#
+# OpenBao path: platform/workloads/railiance/backup/offsite-lane
+# Fields synced (never AGE_PRIVATE_KEY):
+#   NC_WEBDAV_TOKEN, NC_WEBDAV_URL
+# AGE_PUBLIC_KEY is not secret material; injected via ConfigMap/env default in CLI.
+#
+# Catalog: warden route show railiance-backup-offsite-lane
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-backup-offsite
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: NC_WEBDAV_TOKEN
+      remoteRef:
+        key: platform/workloads/railiance/backup/offsite-lane
+        property: NC_WEBDAV_TOKEN
+    - secretKey: NC_WEBDAV_URL
+      remoteRef:
+        key: platform/workloads/railiance/backup/offsite-lane
+        property: NC_WEBDAV_URL

k8s/railiance/20-runtime.yaml

@@ -1244,6 +1244,15 @@ spec:
           ports:
             - name: metrics
               containerPort: 9090
+          env:
+            - name: ISSUE_SINK_TYPE
+              value: state-hub
+            - name: KUBECONFIG_R01
+              value: /kube/config-hosteurope
+            - name: KUBECONFIG_CORE
+              value: /kube/config
+            - name: PATH
+              value: /opt/railiance-platform/tools/vendor/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
           envFrom:
             - configMapRef:
                 name: actcore-runtime-config
@@ -1264,6 +1273,12 @@ spec:
             - name: custodian-runtime
               mountPath: /var/custodian/runtime/prompts
               readOnly: true
+            - name: railiance-platform
+              mountPath: /opt/railiance-platform
+              readOnly: true
+            - name: kubeconfigs
+              mountPath: /kube
+              readOnly: true
       volumes:
         - name: external-activity-definitions
           configMap:
@@ -1281,6 +1296,14 @@ spec:
         - name: custodian-runtime
           configMap:
             name: actcore-custodian-runtime
+        - name: railiance-platform
+          hostPath:
+            path: /home/tegwick/railiance-platform
+            type: Directory
+        - name: kubeconfigs
+          hostPath:
+            path: /home/tegwick/.kube
+            type: Directory
 ---
 apiVersion: apps/v1
 kind: Deployment

k8s/railiance/25-worker-backup-mounts.yaml

@@ -0,0 +1,41 @@
+# Strategic merge patch fragments for actcore-worker backup automation.
+# Apply with: kubectl -n activity-core patch deploy actcore-worker --patch-file ...
+#
+# Adds:
+#   - hostPath kubeconfigs (/home/tegwick/.kube → /kube)
+#   - ensure railiance-platform hostPath (already live on railiance01)
+#
+# RAILIANCE-WP-0016-T04/T05
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: actcore-worker
+  namespace: activity-core
+spec:
+  template:
+    spec:
+      containers:
+        - name: worker
+          env:
+            - name: KUBECONFIG_R01
+              value: /kube/config-hosteurope
+            - name: KUBECONFIG_CORE
+              value: /kube/config
+            - name: PATH
+              value: /opt/railiance-platform/tools/vendor/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+          volumeMounts:
+            - name: kubeconfigs
+              mountPath: /kube
+              readOnly: true
+            - name: railiance-platform
+              mountPath: /opt/railiance-platform
+              readOnly: true
+      volumes:
+        - name: kubeconfigs
+          hostPath:
+            path: /home/tegwick/.kube
+            type: Directory
+        - name: railiance-platform
+          hostPath:
+            path: /home/tegwick/railiance-platform
+            type: Directory

k8s/railiance/26-worker-cnpg-backup-rbac.yaml

@@ -0,0 +1,38 @@
+# Optional in-cluster RBAC if using service-account kubeconfig for railiance01
+# databases dumps (alternative to host kubeconfig admin). Prefer host kubeconfig
+# with limited certs for multi-cluster; this Role covers same-cluster exec.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: actcore-cnpg-logical-backup
+  namespace: databases
+  labels:
+    app.kubernetes.io/part-of: activity-core
+    railiance.apps/backup-lane: option-a
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: actcore-cnpg-logical-backup
+  namespace: databases
+  labels:
+    app.kubernetes.io/part-of: activity-core
+    railiance.apps/backup-lane: option-a
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: actcore-cnpg-logical-backup
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: activity-core