Stand up railiance01 receiver without founder bao kv put

Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.

deploy/externalsecrets.yaml

@@ -17,6 +17,9 @@ spec:
   # Shorter than the platform default of 1h: these are dynamic leases, and the
   # refresh interval bounds how long a revoked lease can remain mounted.
   refreshInterval: 15m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-audit-core-database
   target:
     name: audit-core-database
     creationPolicy: Owner
@@ -32,12 +35,11 @@ spec:
         host: platform-pg-rw.databases.svc.cluster.local
         port: "5432"
         dbname: audit_core
+  # One read = one lease. Two remoteRefs would mint two roles and pair
+  # username from A with password from B — auth then fails.
   dataFrom:
-    - sourceRef:
-        generatorRef:
-          apiVersion: generators.external-secrets.io/v1alpha1
-          kind: VaultDynamicSecret
-          name: audit-core-runtime
+    - extract:
+        key: creds/audit-core-runtime
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -46,6 +48,9 @@ metadata:
   namespace: audit-core
 spec:
   refreshInterval: 15m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-audit-core-database
   target:
     name: audit-core-database-migrate
     creationPolicy: Owner
@@ -59,36 +64,10 @@ spec:
         port: "5432"
         dbname: audit_core
   dataFrom:
-    - sourceRef:
-        generatorRef:
-          apiVersion: generators.external-secrets.io/v1alpha1
-          kind: VaultDynamicSecret
-          name: audit-core-migration
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audit-core-senders
-  namespace: audit-core
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao-audit-core
-  target:
-    name: audit-core-senders
-    creationPolicy: Owner
-    deletionPolicy: Retain
-  data:
-    # The sender registry: which credential may write for which tenant and
-    # source, and each sender's secret_policy. Held in OpenBao rather than the
-    # manifest because it contains bearer tokens.
-    #
-    # Rotation is overlap-first: add the replacement to a sender's `tokens`
-    # list, move the sender, then drop the predecessor. Both are valid in
-    # between, so there is no delivery gap.
-    - secretKey: senders.json
-      remoteRef:
-        # CSS already mounts KV path `platform`; do not repeat the prefix.
-        key: workloads/audit-core/senders
-        property: senders.json
+    - extract:
+        key: creds/audit-core-migration
+# Sender registry is not pulled from OpenBao on first deploy
+# (ops-mason/plans/audit-core-openbao-runtime-custody.md). Tokens are minted
+# in-cluster into Secret audit-core-senders. Apply
+# deploy/externalsecret-senders.yaml only after the Mason wrap-migrate has
+# filled platform/workloads/audit-core/senders.