Retire static OpenBao ESO token bootstrap (RPF-WP-0045-T06)

The openbao-activity-core store has used OpenBao Kubernetes auth since
2026-09-21 and synced cleanly for more than 24 hours. Remove the
openbao-eso-token-apply script and Makefile target, point the manifest
comments and runbooks at the Kubernetes-auth store, and guard against
reintroducing the script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48

scripts/openbao-eso-token-apply.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-# Mint a read-limited OpenBao token on coulombcore (bao.coulomb.social) and store
-# it on railiance01 for ClusterSecretStore openbao-activity-core / ExternalSecrets:
-#   - actcore-issue-core-runtime  (ISSUE_CORE_API_KEY)
-#   - actcore-forgejo-admin       (FORGEJO_TOKEN for package prune)
-#   - actcore-backup-offsite      (NC_WEBDAV_* for Option A backups)
-#   - llm-connect-provider-secrets (OPENROUTER_API_KEY for llm-connect)
-#
-# Default policies (already present in OpenBao; files re-written when present):
-#   workload-kv-read-issue-core-runtime
-#   workload-kv-read-forgejo-admin
-#   workload-kv-read-railiance-backup-offsite-lane
-#   workload-kv-read-llm-connect-provider-secrets
-set -euo pipefail
-
-# Space-separated policy names. Override with OPENBAO_ACTIVITY_CORE_POLICIES.
-DEFAULT_POLICIES="workload-kv-read-issue-core-runtime workload-kv-read-forgejo-admin workload-kv-read-railiance-backup-offsite-lane workload-kv-read-llm-connect-provider-secrets"
-POLICIES="${OPENBAO_ACTIVITY_CORE_POLICIES:-$DEFAULT_POLICIES}"
-POLICY_DIR="${OPENBAO_POLICY_DIR:-$HOME/railiance-platform/openbao/policies}"
-BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
-RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
-SECRET_NAME="${OPENBAO_ACTIVITY_CORE_ESO_SECRET:-openbao-activity-core-eso-token}"
-SECRET_NS="${OPENBAO_ACTIVITY_CORE_ESO_NAMESPACE:-external-secrets}"
-
-if ! command -v bao >/dev/null 2>&1; then
-  echo "ERROR: bao CLI not found" >&2
-  exit 1
-fi
-
-echo "OpenBao addr: $BAO_ADDR"
-echo "Policies: $POLICIES"
-
-if [[ -n "${BAO_TOKEN:-}" ]]; then
-  :
-elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
-  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
-else
-  read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
-  echo >&2
-fi
-
-if [[ -z "${BAO_TOKEN:-}" ]]; then
-  echo "ERROR: empty OpenBao token" >&2
-  exit 1
-fi
-
-export BAO_ADDR BAO_TOKEN
-
-health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"
-if echo "$health" | grep -q '"sealed":true'; then
-  echo "ERROR: OpenBao at $BAO_ADDR reports sealed" >&2
-  exit 1
-fi
-
-policy_flags=()
-for policy in $POLICIES; do
-  policy_file="$POLICY_DIR/${policy}.hcl"
-  if [[ -f "$policy_file" ]]; then
-    bao policy write "$policy" "$policy_file"
-  else
-    echo "WARN: policy file missing ($policy_file); using existing OpenBao policy '$policy'" >&2
-  fi
-  policy_flags+=(-policy="$policy")
-done
-
-token_json="$(bao token create "${policy_flags[@]}" \
-  -display-name="eso-activity-core-runtime" \
-  -period=720h \
-  -format=json)"
-token="$(python3 -c "import json,sys; print(json.load(sys.stdin)['auth']['client_token'])" <<<"$token_json")"
-
-KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create namespace "$SECRET_NS" --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
-KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create secret generic "$SECRET_NAME" \
-  --namespace "$SECRET_NS" \
-  --from-literal=token="$token" \
-  --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
-
-unset BAO_TOKEN token token_json
-echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"
-echo "ok: policies attached: $POLICIES"