Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

deploy/vaultdynamicsecrets.yaml

@@ -0,0 +1,41 @@
+# Dynamic PostgreSQL leases (AUDIT-WP-0005-T02).
+#
+# These are not KV secrets. Copying a lease into platform/workloads/... would
+# freeze a rotating credential and recreate the delivery-gap problem the
+# mounted directory exists to avoid. ESO's VaultDynamicSecret generator reads
+# database/creds/* on each refresh and writes username/password files that
+# audit-core re-reads on the next connection.
+#
+# Prerequisite: Secret external-secrets/openbao-audit-core-eso-token.
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: VaultDynamicSecret
+metadata:
+  name: audit-core-runtime
+  namespace: audit-core
+spec:
+  path: database/creds/audit-core-runtime
+  method: GET
+  provider:
+    server: http://openbao.openbao.svc:8200
+    auth:
+      tokenSecretRef:
+        name: openbao-audit-core-eso-token
+        namespace: external-secrets
+        key: token
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: VaultDynamicSecret
+metadata:
+  name: audit-core-migration
+  namespace: audit-core
+spec:
+  path: database/creds/audit-core-migration
+  method: GET
+  provider:
+    server: http://openbao.openbao.svc:8200
+    auth:
+      tokenSecretRef:
+        name: openbao-audit-core-eso-token
+        namespace: external-secrets
+        key: token