Add ExternalSecret for ISSUE_CORE_API_KEY on Railiance

Sync the shared issue-core ingestion key from OpenBao into
actcore-runtime-secret via External Secrets, with an interim coulombcore
ClusterSecretStore bootstrap script and deploy docs. Removes manual key
injection from bootstrap-secrets.sh.

SCOPE.md

@@ -181,12 +181,12 @@ The two evaluation modes:
   runtime projection failure. The ops inventory probe path has live fallback
   evidence in State Hub; Inter-Hub per-entity submission remains deferred.
 - **Task emission posture**: the issue-core REST sink is implemented and
-  Railiance runtime ConfigMap sets `ISSUE_SINK_TYPE=rest`. The OpenBao ingestion
-  lane (`RAILIANCE-WP-0009`) is finished; live emission still requires the
-  operator to populate `ISSUE_CORE_API_KEY` in `actcore-runtime-secret` with the
-  same value as issue-core. `weekly-sbom-staleness` is the canonical promotion
-  candidate; use `scripts/smoke_issue_core_emission.py` before trusting production
-  task creation.
+  Railiance runtime ConfigMap sets `ISSUE_SINK_TYPE=rest`. `ISSUE_CORE_API_KEY`
+  is synced into `actcore-runtime-secret` by ExternalSecret
+  `actcore-issue-core-runtime` (OpenBao path shared with issue-core). Bootstrap
+  the ESO token with `make openbao-eso-token-apply`. `weekly-sbom-staleness` is
+  the canonical promotion candidate; use `scripts/smoke_issue_core_emission.py`
+  before trusting production task creation.
 - **Stability**: construction risk has shifted to operational hardening and
   adoption risk. The last recorded full-suite pass in the workplans was
   2026-06-04 (`128 passed, 1 skipped`), with later targeted coverage added for