Finish ACTIVITY-WP-0023: ESO FORGEJO_TOKEN and gap dispositions

Ship ExternalSecret actcore-forgejo-admin and multi-policy ESO token
bootstrap so weekly prune credentials refresh without bootstrap inject.
Disposition issue-core path A and MarkiTect ROS as external owners;
close workplan finished.

k8s/railiance/15-externalsecret-forgejo-admin.yaml

@@ -0,0 +1,41 @@
+# Sync FORGEJO_TOKEN from OpenBao into actcore-runtime-secret.
+#
+# Prereqs on railiance01:
+#   - External Secrets Operator (namespace external-secrets)
+#   - ClusterSecretStore openbao-activity-core (railiance-platform addon)
+#   - Secret external-secrets/openbao-activity-core-eso-token with policies:
+#       workload-kv-read-issue-core-runtime
+#       workload-kv-read-forgejo-admin
+#     (scripts/openbao-eso-token-apply.sh)
+#
+# OpenBao path: platform/workloads/forgejo/forgejo-admin
+#   property: API_TOKEN  →  secret key FORGEJO_TOKEN
+# Catalog: warden route show forgejo-admin-api-token
+#
+# Merge keeps bootstrap-owned keys (ACTCORE_DB_URL, webhook secrets) and the
+# ISSUE_CORE_API_KEY ExternalSecret merge intact. Retires one-shot
+# `kubectl patch secret` bootstrap for the weekly package prune (WP-0023-T05).
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-forgejo-admin
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: FORGEJO_TOKEN
+      remoteRef:
+        key: platform/workloads/forgejo/forgejo-admin
+        property: API_TOKEN

k8s/railiance/README.md

@@ -12,6 +12,8 @@ name and access policy.
   NATS JetStream, Temporal, and Temporal UI
 - `15-externalsecret-issue-core.yaml`: OpenBao → `ISSUE_CORE_API_KEY` merge into
   `actcore-runtime-secret` via External Secrets
+- `15-externalsecret-forgejo-admin.yaml`: OpenBao → `FORGEJO_TOKEN` merge for
+  weekly package prune (ACTIVITY-WP-0023-T05)
 - `20-runtime.yaml`: migrate/sync jobs plus API, worker, and event-router
 - `bootstrap-secrets.sh`: idempotently creates generated Kubernetes secrets
 
@@ -28,15 +30,20 @@ provisions the Inter-Hub ops-hub key.
 
 `ISSUE_SINK_TYPE` defaults to **`state-hub`** (ACTIVITY-WP-0022; no silent Forgejo
 issues). Set `rest` only for intentional issue-core projection when the backend
-is healthy. `ISSUE_CORE_API_KEY`
-is synced from OpenBao into `actcore-runtime-secret` by ExternalSecret
-`actcore-issue-core-runtime` (same path as issue-core:
-`platform/workloads/issue-core/issue-core/issue-core-runtime`). Prereqs:
-`ClusterSecretStore/openbao-activity-core` and ESO token bootstrap
-(`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh`).
-Roll back to audit mode by setting
-`ISSUE_SINK_TYPE=null` and restarting worker and event-router deployments.
-See `docs/issue-core-emission-boundary.md`.
+is healthy. `ISSUE_CORE_API_KEY` and `FORGEJO_TOKEN` are synced from OpenBao into
+`actcore-runtime-secret` by ExternalSecrets:
+
+| ExternalSecret | OpenBao path | Secret key |
+| --- | --- | --- |
+| `actcore-issue-core-runtime` | `platform/workloads/issue-core/issue-core/issue-core-runtime` | `ISSUE_CORE_API_KEY` |
+| `actcore-forgejo-admin` | `platform/workloads/forgejo/forgejo-admin` (`API_TOKEN`) | `FORGEJO_TOKEN` |
+
+Prereqs: `ClusterSecretStore/openbao-activity-core` and ESO token bootstrap with
+both read policies (`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token
+./scripts/openbao-eso-token-apply.sh` — attaches
+`workload-kv-read-issue-core-runtime` + `workload-kv-read-forgejo-admin`).
+Roll back to audit mode by setting `ISSUE_SINK_TYPE=null` and restarting worker
+and event-router deployments. See `docs/issue-core-emission-boundary.md`.
 
 The same runtime projection now includes the active
 `daily-statehub-wsjf-triage.md` ActivityDefinition plus its JSON output schema
@@ -71,11 +78,13 @@ ssh railiance01
 cd ~/activity-core
 bash k8s/railiance/bootstrap-secrets.sh
 kubectl apply -f k8s/railiance/10-infrastructure.yaml
-# Bootstrap OpenBao ESO token + apply ExternalSecret (once per cluster):
+# Bootstrap OpenBao ESO token + apply ExternalSecrets (once per cluster):
 OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh
 kubectl apply -f ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml
 kubectl apply -f k8s/railiance/15-externalsecret-issue-core.yaml
+kubectl apply -f k8s/railiance/15-externalsecret-forgejo-admin.yaml
 kubectl -n activity-core wait --for=condition=Ready externalsecret/actcore-issue-core-runtime --timeout=120s
+kubectl -n activity-core wait --for=condition=Ready externalsecret/actcore-forgejo-admin --timeout=120s
 kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-app-db --timeout=180s
 kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-temporal-db --timeout=180s
 kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-nats --timeout=180s