Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

deploy/audit-core.yaml

@@ -93,6 +93,10 @@ spec:
             # to the development store.
             - name: AUDIT_CORE_REQUIRE_CUSTODY_CLASS
               value: archive
+            # Runtime role cannot CREATE TABLE. Schema changes are a Job
+            # with the migration lease (deploy/migrate-job.yaml).
+            - name: AUDIT_CORE_AUTO_MIGRATE
+              value: "0"
             - name: AUDIT_CORE_DATABASE_SCHEMA
               value: audit_core
             - name: AUDIT_CORE_THREADS