feat: enable daily CNPG Option A backup on railiance01

Wire worker kubeconfig hostPath (no PATH override), enable
daily-cnpg-option-a-backup for R01 targets, ESO already synced.

activity-definitions/daily-cnpg-option-a-backup.md

@@ -1,7 +1,7 @@
 ---
 id: daily-cnpg-option-a-backup
 name: Daily CNPG Option A Backup
-enabled: false
+enabled: true
 owner: custodian-agent
 governance: custodian
 status: active
@@ -18,8 +18,11 @@ context_sources:
       backup_script: /opt/railiance-platform/tools/cmd/cnpg-option-a-backup
       dry_run: false
       timeout_seconds: 7200
+      # worker-writable cache
+      # (CLI defaults to /tmp if HOME unwritable)
       kubeconfig_r01: /kube/config-hosteurope
       kubeconfig_core: /kube/config
+      targets: r01-forgejo-db,r01-net-kingdom-pg,r01-state-hub-db
       evidence_sinks:
         - type: state-hub-progress
           event_type: cnpg_option_a_backup

k8s/railiance/20-runtime.yaml

@@ -1251,8 +1251,8 @@ spec:
               value: /kube/config-hosteurope
             - name: KUBECONFIG_CORE
               value: /kube/config
-            - name: PATH
-              value: /opt/railiance-platform/tools/vendor/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+            # Do not override PATH — image venv must stay first for temporalio/etc.
+            # Backup CLI prepends tools/vendor/bin itself.
           envFrom:
             - configMapRef:
                 name: actcore-runtime-config

src/activity_core/context_resolvers/cnpg_backup.py

@@ -26,10 +26,10 @@ def cnpg_option_a_backup(params: dict[str, Any]) -> dict[str, Any]:
     targets = params.get("targets")  # optional CSV
 
     env = os.environ.copy()
-    # Ensure vendor bin (age/kubectl) is visible when hostPath is mounted.
+    # Prepend vendor bin (age/kubectl) without wiping the image PATH/venv.
     vendor = Path("/opt/railiance-platform/tools/vendor/bin")
     if vendor.is_dir():
-        env["PATH"] = f"{vendor}:{env.get('PATH', '')}"
+        env["PATH"] = f"{vendor}:{env.get('PATH', '/usr/local/bin:/usr/bin:/bin')}"
 
     if dry_run:
         env["RAILIANCE_BACKUP_DRY_RUN"] = "1"