Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

audit_core/ingestion.py

@@ -499,6 +499,10 @@ def build_backend() -> IdempotentAuditBackend:
             statement_timeout_ms=int(
                 os.environ.get("AUDIT_CORE_DB_STATEMENT_TIMEOUT_MS", "30000")
             ),
+            # Production mounts the runtime role, which cannot CREATE TABLE.
+            # Schema changes run as a Job with the migration lease
+            # (AUDIT-WP-0005-T02). Local and brokered use keep the default.
+            migrate=_env_flag("AUDIT_CORE_AUTO_MIGRATE", default=True),
         )
     path = os.environ.get("AUDIT_CORE_DATABASE_PATH", "/data/audit-core.db")
     log.warning(
@@ -508,6 +512,14 @@ def build_backend() -> IdempotentAuditBackend:
     return SQLiteAuditBackend(path)
 
 
+def _env_flag(name: str, *, default: bool) -> bool:
+    """Parse a boolean environment flag. Unset or empty keeps ``default``."""
+    raw = os.environ.get(name)
+    if raw is None or not raw.strip():
+        return default
+    return raw.strip().lower() not in {"0", "false", "no", "off"}
+
+
 def main() -> None:
     logging.basicConfig(
         level=os.environ.get("AUDIT_CORE_LOG_LEVEL", "INFO"),