feat: daily CNPG Option A backup shell activity (RAILIANCE-WP-0016)

Add cnpg_option_a_backup resolver, disabled ActivityDefinition, ESO
manifest, worker kubeconfig hostPath, databases RBAC, and unit tests.
Enable after ESO token re-mint and host kubeconfig wiring.

tests/test_cnpg_option_a_backup_resolver.py

@@ -0,0 +1,62 @@
+"""Unit tests for cnpg_option_a_backup shell resolver."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from activity_core.context_resolvers.cnpg_backup import cnpg_option_a_backup
+
+
+def test_missing_script_raises(tmp_path: Path) -> None:
+    with pytest.raises(FileNotFoundError):
+        cnpg_option_a_backup({"backup_script": str(tmp_path / "nope")})
+
+
+def test_happy_path_parses_json(tmp_path: Path) -> None:
+    script = tmp_path / "cnpg-option-a-backup"
+    script.write_text("#!/bin/sh\n")
+    script.chmod(0o755)
+    payload = {
+        "kind": "cnpg_option_a_backup",
+        "overall": "ok",
+        "dry_run": True,
+        "dumped": 1,
+        "uploaded": 0,
+        "failed": 0,
+        "targets": [],
+    }
+    completed = MagicMock(
+        returncode=0,
+        stdout=json.dumps(payload),
+        stderr="log line",
+    )
+    with patch("activity_core.context_resolvers.cnpg_backup.subprocess.run", return_value=completed):
+        result = cnpg_option_a_backup(
+            {"backup_script": str(script), "dry_run": True, "timeout_seconds": 30}
+        )
+    assert result["kind"] == "cnpg_option_a_backup"
+    assert result["overall"] == "ok"
+    assert result["script_exit_code"] == 0
+
+
+def test_degraded_exit_2_still_parses(tmp_path: Path) -> None:
+    script = tmp_path / "cnpg-option-a-backup"
+    script.write_text("#!/bin/sh\n")
+    script.chmod(0o755)
+    payload = {
+        "kind": "cnpg_option_a_backup",
+        "overall": "degraded",
+        "dumped": 1,
+        "uploaded": 0,
+        "failed": 1,
+        "targets": [],
+    }
+    completed = MagicMock(returncode=2, stdout=json.dumps(payload), stderr="")
+    with patch("activity_core.context_resolvers.cnpg_backup.subprocess.run", return_value=completed):
+        result = cnpg_option_a_backup({"backup_script": str(script)})
+    assert result["overall"] == "degraded"
+    assert result["script_exit_code"] == 2