fix: reconcile llm-connect provider secret delivery

tests/test_openbao_eso_token_contract.py

@@ -0,0 +1,26 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_activity_core_eso_token_covers_every_declared_runtime_lane():
+    script = (ROOT / "scripts" / "openbao-eso-token-apply.sh").read_text(encoding="utf-8")
+    required_policies = {
+        "workload-kv-read-issue-core-runtime",
+        "workload-kv-read-forgejo-admin",
+        "workload-kv-read-railiance-backup-offsite-lane",
+        "workload-kv-read-llm-connect-provider-secrets",
+    }
+
+    default_line = next(
+        line for line in script.splitlines() if line.startswith("DEFAULT_POLICIES=")
+    )
+    for policy in required_policies:
+        assert policy in default_line
+
+
+def test_railiance_runbook_applies_and_waits_for_llm_connect_external_secret():
+    runbook = (ROOT / "k8s" / "railiance" / "README.md").read_text(encoding="utf-8")
+    assert "llm-connect/deploy/k8s/activity-core-llm-connect/externalsecret.yaml" in runbook
+    assert "externalsecret/llm-connect-provider-secrets --timeout=120s" in runbook