feat: daily CNPG Option A backup shell activity (RAILIANCE-WP-0016)

Add cnpg_option_a_backup resolver, disabled ActivityDefinition, ESO
manifest, worker kubeconfig hostPath, databases RBAC, and unit tests.
Enable after ESO token re-mint and host kubeconfig wiring.

k8s/railiance/20-runtime.yaml

@@ -1244,6 +1244,15 @@ spec:
           ports:
             - name: metrics
               containerPort: 9090
+          env:
+            - name: ISSUE_SINK_TYPE
+              value: state-hub
+            - name: KUBECONFIG_R01
+              value: /kube/config-hosteurope
+            - name: KUBECONFIG_CORE
+              value: /kube/config
+            - name: PATH
+              value: /opt/railiance-platform/tools/vendor/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
           envFrom:
             - configMapRef:
                 name: actcore-runtime-config
@@ -1264,6 +1273,12 @@ spec:
             - name: custodian-runtime
               mountPath: /var/custodian/runtime/prompts
               readOnly: true
+            - name: railiance-platform
+              mountPath: /opt/railiance-platform
+              readOnly: true
+            - name: kubeconfigs
+              mountPath: /kube
+              readOnly: true
       volumes:
         - name: external-activity-definitions
           configMap:
@@ -1281,6 +1296,14 @@ spec:
         - name: custodian-runtime
           configMap:
             name: actcore-custodian-runtime
+        - name: railiance-platform
+          hostPath:
+            path: /home/tegwick/railiance-platform
+            type: Directory
+        - name: kubeconfigs
+          hostPath:
+            path: /home/tegwick/.kube
+            type: Directory
 ---
 apiVersion: apps/v1
 kind: Deployment