feat: daily CNPG Option A backup shell activity (RAILIANCE-WP-0016)

Add cnpg_option_a_backup resolver, disabled ActivityDefinition, ESO
manifest, worker kubeconfig hostPath, databases RBAC, and unit tests.
Enable after ESO token re-mint and host kubeconfig wiring.

k8s/railiance/15-externalsecret-backup-offsite.yaml

@@ -0,0 +1,41 @@
+# Sync Option A offsite backup credentials into actcore-runtime-secret.
+#
+# Prereqs on railiance01:
+#   - ClusterSecretStore openbao-activity-core
+#   - ESO token includes policy workload-kv-read-railiance-backup-offsite-lane
+#     (scripts/openbao-eso-token-apply.sh defaults updated in RAILIANCE-WP-0016)
+#
+# OpenBao path: platform/workloads/railiance/backup/offsite-lane
+# Fields synced (never AGE_PRIVATE_KEY):
+#   NC_WEBDAV_TOKEN, NC_WEBDAV_URL
+# AGE_PUBLIC_KEY is not secret material; injected via ConfigMap/env default in CLI.
+#
+# Catalog: warden route show railiance-backup-offsite-lane
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-backup-offsite
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: NC_WEBDAV_TOKEN
+      remoteRef:
+        key: platform/workloads/railiance/backup/offsite-lane
+        property: NC_WEBDAV_TOKEN
+    - secretKey: NC_WEBDAV_URL
+      remoteRef:
+        key: platform/workloads/railiance/backup/offsite-lane
+        property: NC_WEBDAV_URL