Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

docs/senders.example.json

@@ -0,0 +1,20 @@
+[
+  {
+    "name": "user-engine",
+    "tokens": ["replace-with-write-token"],
+    "sources": ["user-engine"],
+    "tenants": ["*"],
+    "may_write": true,
+    "may_read": false,
+    "secret_policy": "redact"
+  },
+  {
+    "name": "operator",
+    "tokens": ["replace-with-read-token"],
+    "sources": ["user-engine"],
+    "tenants": ["*"],
+    "may_write": true,
+    "may_read": true,
+    "secret_policy": "redact"
+  }
+]