Finish ACTIVITY-WP-0023: ESO FORGEJO_TOKEN and gap dispositions

Ship ExternalSecret actcore-forgejo-admin and multi-policy ESO token
bootstrap so weekly prune credentials refresh without bootstrap inject.
Disposition issue-core path A and MarkiTect ROS as external owners;
close workplan finished.

scripts/openbao-eso-token-apply.sh

@@ -1,11 +1,18 @@
 #!/usr/bin/env bash
 # Mint a read-limited OpenBao token on coulombcore (bao.coulomb.social) and store
-# it on railiance01 for ClusterSecretStore openbao-activity-core / ExternalSecret
-# actcore-issue-core-runtime.
+# it on railiance01 for ClusterSecretStore openbao-activity-core / ExternalSecrets:
+#   - actcore-issue-core-runtime  (ISSUE_CORE_API_KEY)
+#   - actcore-forgejo-admin       (FORGEJO_TOKEN for package prune)
+#
+# Default policies (already present in OpenBao; files re-written when present):
+#   workload-kv-read-issue-core-runtime
+#   workload-kv-read-forgejo-admin
 set -euo pipefail
 
-POLICY_NAME="${OPENBAO_ACTIVITY_CORE_POLICY:-workload-kv-read-issue-core-runtime}"
-POLICY_FILE="${OPENBAO_ACTIVITY_CORE_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-issue-core-runtime.hcl}"
+# Space-separated policy names. Override with OPENBAO_ACTIVITY_CORE_POLICIES.
+DEFAULT_POLICIES="workload-kv-read-issue-core-runtime workload-kv-read-forgejo-admin"
+POLICIES="${OPENBAO_ACTIVITY_CORE_POLICIES:-$DEFAULT_POLICIES}"
+POLICY_DIR="${OPENBAO_POLICY_DIR:-$HOME/railiance-platform/openbao/policies}"
 BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
 RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
 SECRET_NAME="${OPENBAO_ACTIVITY_CORE_ESO_SECRET:-openbao-activity-core-eso-token}"
@@ -16,13 +23,8 @@ if ! command -v bao >/dev/null 2>&1; then
   exit 1
 fi
 
-if [[ ! -f "$POLICY_FILE" ]]; then
-  echo "ERROR: policy file missing: $POLICY_FILE" >&2
-  exit 1
-fi
-
 echo "OpenBao addr: $BAO_ADDR"
-echo "Policy: $POLICY_NAME"
+echo "Policies: $POLICIES"
 
 if [[ -n "${BAO_TOKEN:-}" ]]; then
   :
@@ -46,8 +48,21 @@ if echo "$health" | grep -q '"sealed":true'; then
   exit 1
 fi
 
-bao policy write "$POLICY_NAME" "$POLICY_FILE"
-token_json="$(bao token create -policy="$POLICY_NAME" -display-name="eso-activity-core-issue-sink" -period=720h -format=json)"
+policy_flags=()
+for policy in $POLICIES; do
+  policy_file="$POLICY_DIR/${policy}.hcl"
+  if [[ -f "$policy_file" ]]; then
+    bao policy write "$policy" "$policy_file"
+  else
+    echo "WARN: policy file missing ($policy_file); using existing OpenBao policy '$policy'" >&2
+  fi
+  policy_flags+=(-policy="$policy")
+done
+
+token_json="$(bao token create "${policy_flags[@]}" \
+  -display-name="eso-activity-core-runtime" \
+  -period=720h \
+  -format=json)"
 token="$(python3 -c "import json,sys; print(json.load(sys.stdin)['auth']['client_token'])" <<<"$token_json")"
 
 KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create namespace "$SECRET_NS" --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
@@ -57,4 +72,5 @@ KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create secret generic "$SECRET_NAME
   --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
 
 unset BAO_TOKEN token token_json
-echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"
+echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"
+echo "ok: policies attached: $POLICIES"