Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

deploy/migrate-job.yaml

@@ -0,0 +1,66 @@
+# One-shot schema apply (AUDIT-WP-0005-T02).
+#
+# Uses the migration lease, not the runtime lease. The runtime Deployment
+# sets AUDIT_CORE_AUTO_MIGRATE=0 so a leaked app credential cannot change
+# the schema. Re-apply after deleting the previous Job when a new migration
+# ships (Jobs are immutable).
+#
+# Image digest must match deploy/audit-core.yaml.
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: audit-core-migrate
+  namespace: audit-core
+  labels:
+    app.kubernetes.io/name: audit-core
+    app.kubernetes.io/component: migrate
+spec:
+  backoffLimit: 6
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: audit-core
+        app.kubernetes.io/component: migrate
+    spec:
+      restartPolicy: OnFailure
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:REPLACE_AT_RELEASE
+          imagePullPolicy: IfNotPresent
+          command: ["python", "-m", "audit_core", "migrate"]
+          env:
+            - name: AUDIT_CORE_CREDENTIAL_DIR
+              value: /etc/audit-core/db
+            - name: AUDIT_CORE_DATABASE_SCHEMA
+              value: audit_core
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: database-credential
+              mountPath: /etc/audit-core/db
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: database-credential
+          secret:
+            secretName: audit-core-database-migrate
+            defaultMode: 0400