Complete EMAIL-WP-0004 transactional invitation mail delivery.

Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy,
probes), provider failure classification and suppression, T04 unit and live
proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.

deploy/k8s/railiance/externalsecret.yaml

@@ -0,0 +1,44 @@
+# Credential delivery for the transactional receiver (EMAIL-WP-0004-T03).
+#
+# PREREQUISITES (railiance-platform, not this repo):
+#   - ClusterSecretStore openbao-email-connect limited to this namespace
+#   - OpenBao policy external-secrets-email-connect + role external-secrets-email-connect
+#   - Operator-provisioned KV at platform/workloads/email-connect/transactional
+#     (fields listed below; no secret values in Git)
+# Apply order: ClusterSecretStore → this ExternalSecret → Deployment.
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: email-connect-runtime
+  namespace: email-connect
+  labels:
+    app.kubernetes.io/name: email-connect
+    app.kubernetes.io/part-of: email-connect
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-email-connect
+  target:
+    name: email-connect-runtime
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    # Shared bearer for user-engine → email-connect. user-engine holds the same
+    # value as EMAIL_CONNECT_INGEST_TOKEN under its own custody path; this
+    # service never receives SMTP material from the caller.
+    - secretKey: EMAIL_CONNECT_INGEST_TOKEN
+      remoteRef:
+        key: platform/workloads/email-connect/transactional
+        property: EMAIL_CONNECT_INGEST_TOKEN
+    - secretKey: EMAIL_CONNECT_SMTP_USERNAME
+      remoteRef:
+        key: platform/workloads/email-connect/transactional
+        property: EMAIL_CONNECT_SMTP_USERNAME
+    - secretKey: EMAIL_CONNECT_SMTP_PASSWORD
+      remoteRef:
+        key: platform/workloads/email-connect/transactional
+        property: EMAIL_CONNECT_SMTP_PASSWORD