Finish ACTIVITY-WP-0023: ESO FORGEJO_TOKEN and gap dispositions

Ship ExternalSecret actcore-forgejo-admin and multi-policy ESO token
bootstrap so weekly prune credentials refresh without bootstrap inject.
Disposition issue-core path A and MarkiTect ROS as external owners;
close workplan finished.

k8s/railiance/15-externalsecret-forgejo-admin.yaml

@@ -0,0 +1,41 @@
+# Sync FORGEJO_TOKEN from OpenBao into actcore-runtime-secret.
+#
+# Prereqs on railiance01:
+#   - External Secrets Operator (namespace external-secrets)
+#   - ClusterSecretStore openbao-activity-core (railiance-platform addon)
+#   - Secret external-secrets/openbao-activity-core-eso-token with policies:
+#       workload-kv-read-issue-core-runtime
+#       workload-kv-read-forgejo-admin
+#     (scripts/openbao-eso-token-apply.sh)
+#
+# OpenBao path: platform/workloads/forgejo/forgejo-admin
+#   property: API_TOKEN  →  secret key FORGEJO_TOKEN
+# Catalog: warden route show forgejo-admin-api-token
+#
+# Merge keeps bootstrap-owned keys (ACTCORE_DB_URL, webhook secrets) and the
+# ISSUE_CORE_API_KEY ExternalSecret merge intact. Retires one-shot
+# `kubectl patch secret` bootstrap for the weekly package prune (WP-0023-T05).
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-forgejo-admin
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: FORGEJO_TOKEN
+      remoteRef:
+        key: platform/workloads/forgejo/forgejo-admin
+        property: API_TOKEN