feat: daily CNPG Option A backup shell activity (RAILIANCE-WP-0016)

Add cnpg_option_a_backup resolver, disabled ActivityDefinition, ESO
manifest, worker kubeconfig hostPath, databases RBAC, and unit tests.
Enable after ESO token re-mint and host kubeconfig wiring.

k8s/railiance/25-worker-backup-mounts.yaml

@@ -0,0 +1,41 @@
+# Strategic merge patch fragments for actcore-worker backup automation.
+# Apply with: kubectl -n activity-core patch deploy actcore-worker --patch-file ...
+#
+# Adds:
+#   - hostPath kubeconfigs (/home/tegwick/.kube → /kube)
+#   - ensure railiance-platform hostPath (already live on railiance01)
+#
+# RAILIANCE-WP-0016-T04/T05
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: actcore-worker
+  namespace: activity-core
+spec:
+  template:
+    spec:
+      containers:
+        - name: worker
+          env:
+            - name: KUBECONFIG_R01
+              value: /kube/config-hosteurope
+            - name: KUBECONFIG_CORE
+              value: /kube/config
+            - name: PATH
+              value: /opt/railiance-platform/tools/vendor/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+          volumeMounts:
+            - name: kubeconfigs
+              mountPath: /kube
+              readOnly: true
+            - name: railiance-platform
+              mountPath: /opt/railiance-platform
+              readOnly: true
+      volumes:
+        - name: kubeconfigs
+          hostPath:
+            path: /home/tegwick/.kube
+            type: Directory
+        - name: railiance-platform
+          hostPath:
+            path: /home/tegwick/railiance-platform
+            type: Directory