Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.venv
+**/__pycache__
+*.pyc
+.pytest_cache
+.mypy_cache
+.ruff_cache
+tests
+workplans
+docs
+evidence
+deploy
+scripts
+*.egg-info