Sync the shared issue-core ingestion key from OpenBao into actcore-runtime-secret via External Secrets, with an interim coulombcore ClusterSecretStore bootstrap script and deploy docs. Removes manual key injection from bootstrap-secrets.sh.
