Stand up railiance01 receiver without founder bao kv put

Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.

deploy/migrate-job.yaml

@@ -27,6 +27,8 @@ spec:
       restartPolicy: OnFailure
       securityContext:
         runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -63,4 +65,4 @@ spec:
         - name: database-credential
           secret:
             secretName: audit-core-database-migrate
-            defaultMode: 0400
+            defaultMode: 0440