Stand up railiance01 receiver without founder bao kv put

Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.

deploy/externalsecret-senders.yaml

@@ -0,0 +1,23 @@
+# Apply only after ops-mason wrap-migrate has filled
+# platform/workloads/audit-core/senders. Until then the sender registry is
+# Secret audit-core-senders, minted in-cluster (see operator-runbook).
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: audit-core-senders
+  namespace: audit-core
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-audit-core
+  target:
+    name: audit-core-senders
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: senders.json
+      remoteRef:
+        key: workloads/audit-core/senders
+        property: senders.json