Finish ACTIVITY-WP-0009 issue-core task emission promotion

Close the intent-gap workplan by documenting the weekly-sbom-staleness
promotion path, adding a null-sink and live REST smoke script, and recording
rollback steps for Railiance. Update SCOPE and deployment docs to reflect
ISSUE_SINK_TYPE=rest and the remaining actcore-runtime-secret key patch.

k8s/railiance/README.md

@@ -24,6 +24,13 @@ the ConfigMap projection from that file before enabling the probe schedule.
 `OPS_HUB_KEY` is created only as an empty Secret placeholder until the operator
 provisions the Inter-Hub ops-hub key.
 
+`ISSUE_SINK_TYPE` is `rest` in `actcore-runtime-config`. Populate
+`ISSUE_CORE_API_KEY` in `actcore-runtime-secret` with the same value as the
+issue-core runtime secret (`issue-core/issue-core-runtime` via OpenBao lane
+`issue-core-ingestion-api-key`) before trusting live task emission. Roll back
+to audit mode by setting `ISSUE_SINK_TYPE=null` and restarting worker and
+event-router deployments. See `docs/issue-core-emission-boundary.md`.
+
 The same runtime projection now includes the active
 `daily-statehub-wsjf-triage.md` ActivityDefinition plus its JSON output schema
 and a persistent working-memory volume mounted at

k8s/railiance/bootstrap-secrets.sh

@@ -37,5 +37,9 @@ if ! secret_exists actcore-runtime-secret; then
     --from-literal=ACTCORE_DB_URL="$ACTCORE_DB_URL" \
     --from-literal=WEBHOOK_SECRET_GITEA="" \
     --from-literal=WEBHOOK_SECRET_GITHUB="" \
-    --from-literal=OPS_HUB_KEY=""
+    --from-literal=OPS_HUB_KEY="" \
+    --from-literal=ISSUE_CORE_API_KEY=""
 fi
+# When promoting live task emission, patch ISSUE_CORE_API_KEY on
+# actcore-runtime-secret to match issue-core's runtime secret. Never commit the
+# value; use the OpenBao lane documented in issue-core-ingestion-api-key.