Record runtime lease remint and receiver Ready after ESO token refresh

Attended orphan-token remint succeeded. ClusterSecretStore needed a
force-sync to drop the cached 403. ExternalSecrets synced, the mounted
lease rotated, and /readyz returned 200 in 6ms. No secret values.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

docs/evidence/2026-09-14-eso-token-remint.json

@@ -0,0 +1,20 @@
+{
+  "step": "receiver_ready",
+  "observed_at": "2026-09-14T22:08:36+00:00",
+  "secret": "external-secrets/openbao-audit-core-eso-token",
+  "lease_path": "database/creds/audit-core-runtime",
+  "externalsecret": "audit-core/audit-core-database",
+  "clustersecretstore": "Valid",
+  "externalsecret_ready": true,
+  "credential_rotated": true,
+  "readyz": {
+    "status": 200,
+    "dt_seconds": 0.006,
+    "custody_class": "operational",
+    "durable": true,
+    "tamper_evidence": false
+  },
+  "pod": "audit-core-6f6545dcf5-xklmd",
+  "endpoint_ready": true
+}
+