Add ExternalSecret for ISSUE_CORE_API_KEY on Railiance

Sync the shared issue-core ingestion key from OpenBao into
actcore-runtime-secret via External Secrets, with an interim coulombcore
ClusterSecretStore bootstrap script and deploy docs. Removes manual key
injection from bootstrap-secrets.sh.

k8s/railiance/15-externalsecret-issue-core.yaml

@@ -0,0 +1,35 @@
+# Sync ISSUE_CORE_API_KEY from OpenBao into actcore-runtime-secret.
+#
+# Prereqs on railiance01:
+#   - External Secrets Operator (namespace external-secrets)
+#   - ClusterSecretStore openbao-activity-core (railiance-platform addon)
+#   - Secret external-secrets/openbao-activity-core-eso-token (scripts/openbao-eso-token-apply.sh)
+#
+# OpenBao path: platform/workloads/issue-core/issue-core/issue-core-runtime
+#   property: ISSUE_CORE_API_KEY (shared with issue-core ingestion)
+#
+# Merge keeps bootstrap-owned keys (ACTCORE_DB_URL, webhook secrets) intact.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-issue-core-runtime
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: ISSUE_CORE_API_KEY
+      remoteRef:
+        key: platform/workloads/issue-core/issue-core/issue-core-runtime
+        property: ISSUE_CORE_API_KEY