Stand up railiance01 receiver without founder bao kv put

Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.

deploy/audit-core.yaml

@@ -69,6 +69,8 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
         seccompProfile:
           type: RuntimeDefault
       # In-flight events must not be lost on rollout; the app shuts down
@@ -171,4 +173,5 @@ spec:
             # ExternalSecret refreshes, which is what makes restart-free
             # rotation possible.
             secretName: audit-core-database
-            defaultMode: 0400
+            # 0440 + fsGroup 10001: 0400 is root-only and the process cannot read it.
+            defaultMode: 0440