Bind multiple queue worker identities, one token each (WP-0039-T01)

ACTIVITY_CORE_WORKERS maps worker_id=ENV_NAME, where each token env must be
ACTIVITY_CORE_WORKER_TOKEN[_SUFFIX]. Without the map, the legacy single pair
behaves exactly as before. Duplicate identities, missing or shared tokens, a
token equal to the operator token, and an unlisted legacy identity all fail
worker mutations closed with 503. Operator/SSO reads keep working.

Declare per-identity OpenBao paths and an ExternalSecret, not yet applied.
The policy, seeding and rollout are waiting tasks T02-T04, answering
secrets-engine SECRETS-WP-0009-T03 and SECRETS-WP-0011-T04.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48

k8s/railiance/15-externalsecret-worker-tokens.yaml

@@ -0,0 +1,44 @@
+# Sync ops_run queue worker tokens from OpenBao into actcore-runtime-secret.
+#
+# NOT YET APPLIED (ACTIVITY-WP-0039). Apply only after T02 (railiance-platform
+# adds both exact paths to the activity-core-eso role policy) and T03 (the
+# founder seeds both paths). Applying earlier makes the store fail to read,
+# or overwrites the hand-set ACTIVITY_CORE_WORKER_TOKEN with a missing value.
+#
+# Prereqs on railiance01:
+#   - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
+#     Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
+#     RPF-WP-0045)
+#
+# One path per worker identity (field: token), so a consumer lane can be
+# granted exactly one worker's token:
+#   rein-aharness@railiance01          -> ACTIVITY_CORE_WORKER_TOKEN
+#   rein-aharness-metered@railiance01  -> ACTIVITY_CORE_WORKER_TOKEN_METERED
+# The identity map is the non-secret ACTIVITY_CORE_WORKERS in
+# actcore-runtime-config.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-ops-run-worker-tokens
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: ACTIVITY_CORE_WORKER_TOKEN
+      remoteRef:
+        key: platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01
+        property: token
+    - secretKey: ACTIVITY_CORE_WORKER_TOKEN_METERED
+      remoteRef:
+        key: platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01
+        property: token

k8s/railiance/README.md

@@ -45,6 +45,10 @@ workers insert claimable `ops_runs` on emit. Full railiance checklist:
 harness claim client. The non-secret `ACTIVITY_CORE_WORKER_ID` in the runtime
 ConfigMap binds that credential to `rein-aharness@railiance01`; deploy both
 settings together.
+Additional worker identities use the non-secret `ACTIVITY_CORE_WORKERS` map,
+with one OpenBao-held token per identity synced by
+`15-externalsecret-worker-tokens.yaml`. That file is not applied yet; see
+ACTIVITY-WP-0039.
 
 | ExternalSecret | OpenBao path | Secret key |
 | --- | --- | --- |